Generates a report that includes details about when an IAM resource (user, group, role, or policy) was last used in an attempt to access AWS services. Recent activity usually appears within four hours. IAM reports activity for the last 365 days, or less if your Region began supporting this feature within the last year. For more information, see Regions Where Data Is Tracked.
The service last accessed data includes all attempts to access an AWS API, not just the successful ones. This includes all attempts that were made using the AWS Management Console, the AWS API through any of the SDKs, or any of the command line tools. An unexpected entry in the service last accessed data does not mean that your account has been compromised, because the request might have been denied. Refer to your CloudTrail logs as the authoritative source for information about all API calls and whether they were successful or denied access. For more information, see Logging IAM Events with CloudTrail in the IAM User Guide.
The
generate_service_last_accessed_details
operation returns a JobId. Use this parameter in the following
operations to retrieve the following details from your report:
get_service_last_accessed_details
– Use this operation for users, groups, roles, or policies to list
every AWS service that the resource could access using permissions
policies. For each service, the response includes information about
the most recent access attempt.
The JobId returned by GenerateServiceLastAccessedDetail must be
used by the same role within a session, or by the same user when
used to call GetServiceLastAccessedDetail.
get_service_last_accessed_details_with_entities
– Use this operation for groups and policies to list information
about the associated entities (users or roles) that attempted to
access a specific AWS service.
To check the status of the
generate_service_last_accessed_details
request, use the JobId parameter in the same operations and test the
JobStatus response parameter.
For additional information about the permissions policies that allow an
identity (user, group, or role) to access specific services, use the
list_policies_granting_service_access
operation.
Service last accessed data does not use other policy types when determining whether a resource could access a service. These other policy types include resource-based policies, access control lists, AWS Organizations policies, IAM permissions boundaries, and AWS STS assume role policies. It only applies permissions policy logic. For more about the evaluation of policy types, see Evaluating Policies in the IAM User Guide.
For more information about service and action last accessed data, see Reducing Permissions Using Service Last Accessed Data in the IAM User Guide.
iam_generate_service_last_accessed_details(Arn, Granularity)A list with the following syntax:
list(
JobId = "string"
)
[required] The ARN of the IAM resource (user, group, role, or managed policy) used to generate information about when the resource was last used in an attempt to access an AWS service.
The level of detail that you want to generate. You can specify whether you want to generate information about the last attempt to access services or actions. If you specify service-level granularity, this operation generates only service data. If you specify action-level granularity, it generates service and action data. If you don't include this optional parameter, the operation generates service data.
svc$generate_service_last_accessed_details(
Arn = "string",
Granularity = "SERVICE_LEVEL"|"ACTION_LEVEL"
)
if (FALSE) {
# The following operation generates a report for the policy:
# ExamplePolicy1
svc$generate_service_last_accessed_details(
Arn = "arn:aws:iam::123456789012:policy/ExamplePolicy1"
)
}
Run the code above in your browser using DataLab