0

In our scenario, We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or if they were perhaps not using these credentials?

The ATHENA Queries I was tried

SELECT eventTime, eventName, userIdentity.principalId,eventSource
FROM athena-table
WHERE useridentity.accesskeyid like 'AKIAIOSFODNN7EXAMPLE'

SELECT *
FROM athena-table
WHERE useridentity.type = 'IAMUser'
AND useridentity.username LIKE 'Alice';

In the IAM Console Last activity is shown as Never.

We'll be deleting that user but prior to doing that I wanted to see how she was using the account without logging. Is there a better way to find out this?

1

1 Answer 1

0

The Credential Report should be the right way to investigate this on the cloud end.

You can get the user to check what they have in ~/.aws/config and ~/.aws/credentials to confirm which credentials they're using.

It looks like this:

[profile_name]
aws_access_key_id = SHORTERSTRING
aws_secret_access_key = LONGERSTRINGGOESHEREWITHMORECHARS

Use the credential report to find out when the IAM user last used an access key. If it looks wrong, then you may need to dig in to CloudTrail logs to find out when/where the key is being used.

More gung-ho approach would be to go through revoking the access keys until someone yells at you :D

11
  • Thanks, shearn89, I have an access key and secrete key, can you describe a bit about the procedure. Mar 1, 2022 at 8:58
  • Done, hopefully that points you in the right direction!
    – shearn89
    Mar 1, 2022 at 9:15
  • Tried with cloud trail log and Athena queries but both showed output as no result. Mar 1, 2022 at 11:13
  • shearn89 ,We'll be deleting that user but prior to doing that I wanted to see how she was using the account without it logging. Mar 1, 2022 at 15:43
  • 1
    Is it possible that the user may still have access to an instance having a role that allows upload? Mar 2, 2022 at 9:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .