In our scenario, We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or if they were perhaps not using these credentials?
The ATHENA Queries I was tried
SELECT eventTime, eventName, userIdentity.principalId,eventSource
WHERE useridentity.accesskeyid like 'AKIAIOSFODNN7EXAMPLE'
WHERE useridentity.type = 'IAMUser'
AND useridentity.username LIKE 'Alice';
In the IAM Console Last activity is shown as Never.
We'll be deleting that user but prior to doing that I wanted to see how she was using the account without logging. Is there a better way to find out this?