AWS provides several built-in ways to see IAM access keys and their recent activity: the IAM users list, individual user details, a credential report, the GetAccessKeyLastUsed API or CLI operation, and CloudTrail event history. Which one helps most depends on whether you need a quick visual check, an account-wide CSV, or an investigation of a known key.
Where to see access-key activity in the AWS console
Start with the IAM users list for an interactive review. AWS documents an “Access key last used” column; if it is not visible, enable it in the list’s visible-column preferences. Open a user’s details to see that user’s access-key IDs, status, and last-use information. This is a practical way to spot keys during a user-by-user review, but make sure the identities you need to review are represented in the IAM user view.
As an Amazon Associate I earn from qualifying purchases.
Choose the AWS view that matches the question
| Method | Best for | Scope and limitations |
|---|---|---|
| IAM users list and user details | Quick interactive review of IAM users and key activity | The last-used column may need to be enabled; check which identity types are represented. |
| IAM credential report | Reviewing selected IAM-managed credentials in a CSV | Includes information for the first two access keys per user; it excludes service-specific credentials and keys beyond those first two. AWS permits generating a report at most once every four hours. |
GetAccessKeyLastUsed API or CLI |
Checking the most recent use of a known key ID | Requires the access-key ID and a caller with the necessary permissions; it is a lookup, not an account-wide CSV. |
| CloudTrail event history | Investigating events associated with an access key | AWS re:Post guidance describes a 90-day event-history window. This is a separate investigation source from IAM last-used metadata, not a universal retention guarantee for every CloudTrail configuration or log destination. |
Generate a credential report for a broader review
The IAM credential report is useful when you want to examine selected IAM-managed credential fields across an account in a spreadsheet. Treat its scope carefully: it is not a complete inventory of every AWS credential. Its access-key data covers the first two keys per user, and it does not include service-specific credentials. Reports can be generated no more often than once every four hours, so it is not a continuously refreshing view.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Look up a known key with the CLI or API
If you already have an access-key ID, AWS provides the GetAccessKeyLastUsed operation. The AWS CLI command is:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
aws iam get-access-key-last-used --access-key-id AKIAEXAMPLEReplace AKIAEXAMPLE with the key ID you want to inspect. The caller needs the permissions required for the operation. This method answers a focused question about a known key; use a list or report instead when you need to review multiple IAM users.
Investigate activity in CloudTrail
CloudTrail event history offers a different angle: it helps investigate events associated with an access key, rather than presenting IAM’s last-used metadata. AWS re:Post describes the event-history window as the last 90 days. Do not treat that figure as a guarantee covering every CloudTrail setup or destination; retention depends on the specific logging arrangement.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use visibility to reduce long-term key exposure
A clearer view can support credential cleanup, but it is not a reason to create or keep long-lived keys. Amazon Web Services’ IAM Best Practices says: “Where possible, we recommend relying on temporary credentials instead of creating long-term credentials such as access keys.”
When long-term IAM user keys are still necessary, AWS recommends using last-used information to rotate and remove keys regularly. AWS also advises against using root user access keys. In practice, combine a visibility method with a deliberate review process: identify the keys you own, determine whether they are still required, and remove or rotate unnecessary long-term credentials.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Sources
- AWS IAM: Managing access keys for IAM users
- AWS IAM: Getting credential reports for your AWS account
- AWS IAM Best Practices
- AWS IAM: Best practices for managing AWS access keys
- AWS re:Post: Find IAM user access key activity
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
