How to Audit AWS IAM Permissions for Over-Privilege

The IAM credential report lists all IAM users in the account with metadata about their credentials: last access time, access key age, MFA status, and password last used. This is the starting point for finding unused credentials.

# Generate a fresh credential report
aws iam generate-credential-report

# Download the report (CSV format)
aws iam get-credential-report \
  --query 'Content' \
  --output text | base64 -d > credential-report.csv

# Parse it for high-value findings
# Find users with access keys not used in 90+ days
awk -F',' '
  NR > 1 && $11 != "N/A" && $11 != "no_information" {
    cmd = "date -d " $11 " +%s"
    cmd | getline key_ts
    close(cmd)
    now = systime()
    days = (now - key_ts) / 86400
    if (days > 90) print $1, "- access key not used in", int(days), "days"
  }
' credential-report.csv

# Find users with no MFA
awk -F',' 'NR > 1 && $8 == "false" {print $1, "- no MFA"}' credential-report.csv

# Find users with console access who have never logged in
awk -F',' 'NR > 1 && $5 == "true" && $6 == "no_information" {print $1, "- console enabled, never logged in"}' credential-report.csv

IAM Access Advisor shows the last time each service was accessed by a principal. Any service not accessed in 90 days is a candidate for permission removal.

# Generate a service last-accessed report for a specific IAM user
aws iam generate-service-last-accessed-details \
  --arn arn:aws:iam::123456789012:user/myuser

# Retrieve the report
aws iam get-service-last-accessed-details \
  --job-id <job-id-from-above> \
  --query 'ServicesLastAccessed[?LastAuthenticated==null || LastAuthenticated<=`2026-03-26`].ServiceName'

# For IAM roles: same commands work
aws iam generate-service-last-accessed-details \
  --arn arn:aws:iam::123456789012:role/MyAppRole

# List all roles and check their last-used timestamps
aws iam list-roles \
  --query 'Roles[*].{Name:RoleName, LastUsed:RoleLastUsed.LastUsedDate}' \
  --output table | sort -k4

IAM roles with no LastUsedDate in 90+ days: Consider whether the role is still needed. Unused roles are an attack surface: if they can be assumed, they give attackers their permissions without ever being detected in last-used audits.

Script to list all roles unused for 90+ days:

#!/bin/bash
CUTOFF=$(date -d '90 days ago' --iso-8601=seconds)

aws iam list-roles --query 'Roles[*].{Arn:Arn,Name:RoleName,LastUsed:RoleLastUsed.LastUsedDate}' \
  --output json | \
  jq --arg cutoff "$CUTOFF" '
    .[] | select(.LastUsed == null or .LastUsed < $cutoff) | 
    {Name, LastUsed: (.LastUsed // "never")}
  '

IAM Access Analyzer can analyze 90 days of CloudTrail logs for a role or user and generate a policy that grants only the permissions actually used during that period.

# Start policy generation for a role (uses CloudTrail data from the last 90 days)
aws accessanalyzer start-policy-generation \
  --policy-generation-details '{"principalArn":"arn:aws:iam::123456789012:role/MyAppRole"}' \
  --cloud-trail-details '{
    "accessRole": "arn:aws:iam::123456789012:role/AccessAnalyzerCloudTrailRole",
    "trailArn": "arn:aws:cloudtrail:us-east-1:123456789012:trail/MyTrail",
    "startTime": "2026-03-27T00:00:00Z",
    "endTime": "2026-06-26T00:00:00Z"
  }'

# Wait a few minutes, then retrieve the generated policy
aws accessanalyzer get-generated-policy \
  --job-id <job-id-from-above> \
  --query 'GeneratedPolicyResult.GeneratedPolicies[0].Policy'

The output is a JSON policy document containing only the actions this principal actually used during the analysis period. Apply it as a permission boundary or replace the existing overly-broad policy.

AWS Console alternative: IAM > Users/Roles > [select principal] > Access Advisor tab > Generate policy button

Important caveat: The generated policy covers only actions observed in the analysis window. If a role has permissions for disaster recovery procedures run once a year, those will not appear in a 90-day analysis. Review the generated policy for known infrequent operations before applying it.

Pattern 1: AdministratorAccess on service roles

# Find all roles with AdministratorAccess attached
aws iam list-entities-for-policy \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
  --entity-filter Role \
  --query 'PolicyRoles[*].RoleName'

# For each, check what services it actually calls (via Access Advisor)
# Replace AdministratorAccess with a narrow policy derived from Access Analyzer

# Detach the overly broad policy
aws iam detach-role-policy \
  --role-name MyAppRole \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# Attach the generated least-privilege policy
aws iam put-role-policy \
  --role-name MyAppRole \
  --policy-name MyAppRole-least-privilege \
  --policy-document file://generated-policy.json

Pattern 2: Wildcard S3 permissions

// Over-privileged (before)
{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

// Least privilege (after): specific bucket and object actions
{
  "Effect": "Allow",
  "Action": [
    "s3:GetObject",
    "s3:PutObject"
  ],
  "Resource": [
    "arn:aws:s3:::my-app-bucket",
    "arn:aws:s3:::my-app-bucket/*"
  ]
}

Pattern 3: Stale IAM users for applications (should be roles)

# List all IAM users with active access keys
aws iam list-users | jq -r '.Users[].UserName' | while read user; do
  keys=$(aws iam list-access-keys --user-name "$user" \
    --query 'AccessKeyMetadata[?Status==`Active`].AccessKeyId' \
    --output text)
  if [ -n "$keys" ]; then
    echo "$user: $keys"
  fi
done

# Any application using an IAM user key should migrate to an IAM role
# EC2 → instance profile, Lambda → execution role, ECS → task role
# Migrate, then deactivate and eventually delete the IAM user
aws iam update-access-key \
  --user-name old-app-user \
  --access-key-id AKIAIOSFODNN7EXAMPLE \
  --status Inactive

Pattern 4: Permission boundaries not enforced Permission boundaries cap the maximum permissions a principal can use: even if they are granted broader permissions by a policy, the boundary is the actual ceiling:

# Apply a permission boundary to limit blast radius
aws iam put-role-permissions-boundary \
  --role-name MyAppRole \
  --permissions-boundary arn:aws:iam::123456789012:policy/ProductionBoundary