0

In our scenario, We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or if they were perhaps not using these credentials?

The ATHENA Queries I was tried

SELECT eventTime, eventName, userIdentity.principalId,eventSource
FROM athena-table
WHERE useridentity.accesskeyid like 'AKIAIOSFODNN7EXAMPLE'

SELECT *
FROM athena-table
WHERE useridentity.type = 'IAMUser'
AND useridentity.username LIKE 'Alice';

In the IAM Console Last activity is shown as Never.

We'll be deleting that user but prior to doing that I wanted to see how she was using the account without logging. Is there a better way to find out this?

1

1 Answer 1

0

The Credential Report should be the right way to investigate this on the cloud end.

You can get the user to check what they have in ~/.aws/config and ~/.aws/credentials to confirm which credentials they're using.

It looks like this:

[profile_name]
aws_access_key_id = SHORTERSTRING
aws_secret_access_key = LONGERSTRINGGOESHEREWITHMORECHARS

Use the credential report to find out when the IAM user last used an access key. If it looks wrong, then you may need to dig in to CloudTrail logs to find out when/where the key is being used.

More gung-ho approach would be to go through revoking the access keys until someone yells at you :D

11
  • Thanks, shearn89, I have an access key and secrete key, can you describe a bit about the procedure. Mar 1 at 8:58
  • Done, hopefully that points you in the right direction!
    – shearn89
    Mar 1 at 9:15
  • Tried with cloud trail log and Athena queries but both showed output as no result. Mar 1 at 11:13
  • shearn89 ,We'll be deleting that user but prior to doing that I wanted to see how she was using the account without it logging. Mar 1 at 15:43
  • 1
    Is it possible that the user may still have access to an instance having a role that allows upload? Mar 2 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.