Refining permissions in AWS using last accessed information

Tracking period – Recent activity appears in the IAM console within four hours. The tracking period for service information is at least 400 days depending on when the service started tracking actions information. The tracking period for Amazon S3 actions information began on April, 12, 2020. The tracking period for Amazon EC2, IAM, and Lambda actions began on April 7, 2021. The tracking period for all other services began on May 23, 2023. For a list of services for which action last accessed information is available, see IAM action last accessed information services and actions. For more information on which Regions action last accessed information is available in, see Where AWS tracks last accessed information.

Attempts reported – The service last accessed data includes all attempts to access an AWS API, not just the successful attempts. This includes all attempts that were made using the AWS Management Console, the AWS API through any of the SDKs, or any of the command line tools. An unexpected entry in the service last accessed data does not mean that your account has been compromised, because the request might have been denied. Refer to your CloudTrail logs as the authoritative source for information about all API calls and whether they were successful or denied access.

PassRole – The iam:PassRole action is not tracked and is not included in IAM action last accessed information.

Action last accessed information – Action last accessed information is available for service management actions accessed by IAM identities. See the list of services and their actions for which action last accessed reports information.

Management events – IAM provides action information for service management events that are logged by CloudTrail. Sometimes, CloudTrail management events are also called control plane operations or control plane events. Management events provide visibility into administrative operations that are performed on resources in your AWS account. To learn more about management events in CloudTrail, see Logging management events in the AWS CloudTrail User Guide.

Report owner – Only the principal that generates a report can view the report details. This means that when you view the information in the AWS Management Console, you might have to wait for it to generate and load. If you use the AWS CLI or AWS API to get report details, your credentials must match the credentials of the principal that generated the report. If you use temporary credentials for a role or federated user, you must generate and retrieve the report during the same session. For more information about assumed-role session principals, see AWS JSON policy elements: Principal.

IAM resources – The last accessed information for IAM includes IAM resources (roles, users, user groups, and policies) in your account. Last accessed information for Organizations includes principals (IAM users, IAM roles, or the AWS account root user) in the specified Organizations entity. The last accessed information does not include unauthenticated attempts.

IAM policy types – The last accessed information for IAM includes services that are allowed by an IAM identity's policies. These are policies attached to a role or attached to a user directly or through a group. Access allowed by other policy types is not included in your report. The excluded policy types include resource-based policies, access control lists, AWS Organizations SCPs, IAM permissions boundaries, and session policies. Permissions that are provided by service-linked roles are defined by the service that they are linked to and can't be modified in IAM. To learn more about service-linked roles, see Using service-linked roles To learn how the different policy types are evaluated to allow or deny access, see Policy evaluation logic.

Organizations policy types – The information for AWS Organizations includes only services that are allowed by an Organizations entity's inherited service control policies (SCPs). SCPs are policies attached to a root, OU, or account. Access allowed by other policy types is not included in your report. The excluded policy types include identity-based policies, resource-based policies, access control lists, IAM permissions boundaries, and session policies. To learn how the different policy types are evaluated to allow or deny access, see Policy evaluation logic.

Specifying a policy ID – When you use the AWS CLI or AWS API to generate a report for last accessed information in Organizations, you can optionally specify a policy ID. The resulting report includes information for the services that are allowed by only that policy. The information includes the most recent account activity in the specified Organizations entity or the entity's children. For more information, see aws iam generate-organizations-access-report or GenerateOrganizationsAccessReport.

Organizations management account – You must sign in to your organization's management account to view service last accessed information. You can choose to view information for the management account using the IAM console, the AWS CLI, or the AWS API. The resulting report lists all AWS services, because the management account is not limited by SCPs. If you specify a policy ID in the CLI or API, the policy is ignored. For each service, the report includes information for only the management account. However, reports for other Organizations entities do not return information for activity in the management account.

Organizations settings – An administrator must enable SCPs in your organization root before you can generate data for Organizations.

iam:GenerateServiceLastAccessedDetails

iam:Get*

iam:List*

Which users, groups, or roles are attached to a managed policy

Which services a user or role can access

The last time they accessed the service

The last time they attempted to use a specific Amazon EC2, IAM, Lambda, or Amazon S3 action

iam:GenerateServiceLastAccessedDetails

iam:GetServiceLastAccessedDetails

iam:GetServiceLastAccessedDetailsWithEntities

iam:ListPoliciesGrantingServiceAccess

iam:GenerateOrganizationsAccessReport

iam:GetOrganizationsAccessReport

organizations:DescribeAccount

organizations:DescribeOrganization

organizations:DescribeOrganizationalUnit

organizations:DescribePolicy

organizations:ListChildren

organizations:ListParents

organizations:ListPoliciesForTarget

organizations:ListRoots

organizations:ListTargetsForPolicy

iam:GenerateOrganizationsAccessReport

iam:GetOrganizationsAccessReport

organizations:DescribePolicy

organizations:ListChildren

organizations:ListParents

organizations:ListPoliciesForTarget

organizations:ListRoots

organizations:ListTargetsForPolicy

For action last accessed information, an action that you are expecting to see might not be returned in the list. This can happen either because the IAM identity does not have permissions for the action, or AWS does not yet track the action for last accessed information.

For an IAM user, make sure that the user has at least one inline or managed policy attached, either directly or through group memberships.

For an IAM group, verify that the group has at least one inline or managed policy attached.

For an IAM group, the report returns only the service last accessed information for members that used the group's policies to access a service. To learn whether a member used other policies, review the last accessed information for that user.

For an IAM role, verify that the role has at least one inline or managed policy attached.

For an IAM entity (user or role), review other policy types that might affect the permissions of that entity. These include resource-based policies, access control lists, AWS Organizations policies, IAM permissions boundaries, or session policies. For more information, see Policy types or Evaluating policies within a single account.

For an IAM policy, make sure that the specified managed policy is attached to at least one user, group with members, or role.

For an Organizations entity (root, OU, or account), make sure that you are signed using Organizations management account credentials.

Verify that SCPs are enabled in your organization root.

Action last accessed information is only available for the actions listed in IAM action last accessed information services and actions.

Service information – The tracking period for services is at least 400 days, or less if your Region began tracking this feature within the last 400 days.

Actions information – The tracking period for Amazon S3 management actions began on April, 12, 2020. The tracking period for Amazon EC2, IAM, and Lambda management actions began on April 7, 2021. The tracking period for management actions of all other services began on May 23, 2023. If a Region's tracking date is later than May 23, 2023, then action last accessed information from that Region will start at the later date.