# IAM Security Tools

**IAM Security Tools** in AWS, focusing specifically on:

* **IAM Credential Report**
    
* **IAM Access Advisor**
    

Both of these tools help you **analyze and audit IAM users**, with the goal of improving **security and reducing unused permissions**.

---

## 🛡️ 1. IAM Credential Report (Account-Level)

### ✅ What it is:

A **CSV report** generated by AWS that contains **credential-related information for all IAM users** in your account.

### 📄 What does it include?

For each IAM user, you’ll get details like:

* User creation time
    
* Whether a **password** is enabled
    
* Last time the **password was used**
    
* Whether **MFA (Multi-Factor Authentication)** is enabled
    
* Access key info:
    
    * Active or inactive
        
    * Last used date
        
    * Age of access key (helps identify old/stale keys)
        

### 📌 Why use it?

To **identify weak IAM hygiene**, such as:

* Users without MFA
    
* Users with unused passwords or access keys
    
* Very old credentials (e.g., 90+ days)
    

### 🛠️ How to generate:

AWS Console → IAM → **"Credential Report"** → Click **“Download Report”**

---

## 🔍 2. IAM Last Access (Users-Level)

### ✅ What it is:

It shows you **which services an IAM user or role has accessed** and **when**.

### 📄 What does it include?

* List of services the IAM entity has permissions for
    
* **Last accessed timestamp** for each service
    
* Services never accessed
    

### 📌 Why use it?

To **perform permissions cleanup (least privilege)**:

* Remove permissions for services that were **never accessed**
    
* Identify over-permissioned users or roles
    

#### 🛠️ Where to find:

AWS Console → IAM → Choose a **User or Role** → **Last Access** tab

---

### 💡 Example Use Case

Let’s say you have a user with:

* Access keys that haven’t been used in 6 months
    
* Full admin access but has never accessed half the services
    

Using:

* **Credential Report**, you identify and **rotate or delete stale keys**
    
* **Access Advisor**, you **trim unnecessary permissions**
    

This improves **security posture** and **minimizes attack surface**.

### More AWS SAA Articles

* [IAM Roles for Services](https://jaytillu.com/blogs/iam-roles-for-services)
    
* [AWS IAM User, Root User and Groups](https://jaytillu.com/blogs/aws-iam-user-root-user-and-groups)
    
* [AWS IAM Policies and their structure](https://jaytillu.com/blogs/aws-iam-polices-and-their-structure)
    

### **Follow me for more such content**

* [My YouTube Channel](https://www.youtube.com/@jay_tillu)
    
* [My Site](https://www.jaytillu.com/)
    
* [My Blogs](https://jaytillu.com/blogs)
    
* [LinkedIn](https://www.linkedin.com/in/jaytillu/)
    
* [Instagram](https://www.instagram.com/jay.tillu/)
    
* [Twitter](https://twitter.com/jay_tillu)
    
* [Stackoverflow](https://stackoverflow.com/users/8509590/jay-tillu)
    
* [Github](https://github.com/Jay-Tillu)
    
* [Dev](https://dev.to/jay_tillu)