libZSservicesZSamazonka-iamZSamazonka-iam
Copyright(c) 2013-2021 Brendan Hay
LicenseMozilla Public License, v. 2.0.
MaintainerBrendan Hay <brendan.g.hay+amazonka@gmail.com>
Stabilityauto-generated
Portabilitynon-portable (GHC extensions)
Safe HaskellNone

Amazonka.IAM.GenerateServiceLastAccessedDetails

Description

Generates a report that includes details about when an IAM resource (user, group, role, or policy) was last used in an attempt to access Amazon Web Services services. Recent activity usually appears within four hours. IAM reports activity for the last 365 days, or less if your Region began supporting this feature within the last year. For more information, see Regions where data is tracked.

The service last accessed data includes all attempts to access an Amazon Web Services API, not just the successful ones. This includes all attempts that were made using the Amazon Web Services Management Console, the Amazon Web Services API through any of the SDKs, or any of the command line tools. An unexpected entry in the service last accessed data does not mean that your account has been compromised, because the request might have been denied. Refer to your CloudTrail logs as the authoritative source for information about all API calls and whether they were successful or denied access. For more information, see Logging IAM events with CloudTrail in the IAM User Guide.

The GenerateServiceLastAccessedDetails operation returns a JobId. Use this parameter in the following operations to retrieve the following details from your report:

  • GetServiceLastAccessedDetails – Use this operation for users, groups, roles, or policies to list every Amazon Web Services service that the resource could access using permissions policies. For each service, the response includes information about the most recent access attempt.

    The JobId returned by GenerateServiceLastAccessedDetail must be used by the same role within a session, or by the same user when used to call GetServiceLastAccessedDetail.

  • GetServiceLastAccessedDetailsWithEntities – Use this operation for groups and policies to list information about the associated entities (users or roles) that attempted to access a specific Amazon Web Services service.

To check the status of the GenerateServiceLastAccessedDetails request, use the JobId parameter in the same operations and test the JobStatus response parameter.

For additional information about the permissions policies that allow an identity (user, group, or role) to access specific services, use the ListPoliciesGrantingServiceAccess operation.

Service last accessed data does not use other policy types when determining whether a resource could access a service. These other policy types include resource-based policies, access control lists, Organizations policies, IAM permissions boundaries, and STS assume role policies. It only applies permissions policy logic. For more about the evaluation of policy types, see Evaluating policies in the IAM User Guide.

For more information about service and action last accessed data, see Reducing permissions using service last accessed data in the IAM User Guide.

Synopsis

Creating a Request

data GenerateServiceLastAccessedDetails Source #

Constructors

GenerateServiceLastAccessedDetails' 

Fields

  • granularity :: Maybe AccessAdvisorUsageGranularityType

    The level of detail that you want to generate. You can specify whether you want to generate information about the last attempt to access services or actions. If you specify service-level granularity, this operation generates only service data. If you specify action-level granularity, it generates service and action data. If you don't include this optional parameter, the operation generates service data.

  • arn :: Text

    The ARN of the IAM resource (user, group, role, or managed policy) used to generate information about when the resource was last used in an attempt to access an Amazon Web Services service.

Instances

Instances details
Eq GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

Read GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

Show GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

Generic GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

Associated Types

type Rep GenerateServiceLastAccessedDetails :: Type -> Type #

NFData GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

Hashable GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

AWSRequest GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

ToHeaders GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

ToPath GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

ToQuery GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

type Rep GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

type Rep GenerateServiceLastAccessedDetails = D1 ('MetaData "GenerateServiceLastAccessedDetails" "Amazonka.IAM.GenerateServiceLastAccessedDetails" "libZSservicesZSamazonka-iamZSamazonka-iam" 'False) (C1 ('MetaCons "GenerateServiceLastAccessedDetails'" 'PrefixI 'True) (S1 ('MetaSel ('Just "granularity") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe AccessAdvisorUsageGranularityType)) :*: S1 ('MetaSel ('Just "arn") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text)))
type AWSResponse GenerateServiceLastAccessedDetails Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

newGenerateServiceLastAccessedDetails Source #

Create a value of GenerateServiceLastAccessedDetails with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:granularity:GenerateServiceLastAccessedDetails', generateServiceLastAccessedDetails_granularity - The level of detail that you want to generate. You can specify whether you want to generate information about the last attempt to access services or actions. If you specify service-level granularity, this operation generates only service data. If you specify action-level granularity, it generates service and action data. If you don't include this optional parameter, the operation generates service data.

$sel:arn:GenerateServiceLastAccessedDetails', generateServiceLastAccessedDetails_arn - The ARN of the IAM resource (user, group, role, or managed policy) used to generate information about when the resource was last used in an attempt to access an Amazon Web Services service.

Request Lenses

generateServiceLastAccessedDetails_granularity :: Lens' GenerateServiceLastAccessedDetails (Maybe AccessAdvisorUsageGranularityType) Source #

The level of detail that you want to generate. You can specify whether you want to generate information about the last attempt to access services or actions. If you specify service-level granularity, this operation generates only service data. If you specify action-level granularity, it generates service and action data. If you don't include this optional parameter, the operation generates service data.

generateServiceLastAccessedDetails_arn :: Lens' GenerateServiceLastAccessedDetails Text Source #

The ARN of the IAM resource (user, group, role, or managed policy) used to generate information about when the resource was last used in an attempt to access an Amazon Web Services service.

Destructuring the Response

data GenerateServiceLastAccessedDetailsResponse Source #

Constructors

GenerateServiceLastAccessedDetailsResponse' 

Fields

  • jobId :: Maybe Text

    The JobId that you can use in the GetServiceLastAccessedDetails or GetServiceLastAccessedDetailsWithEntities operations. The JobId returned by GenerateServiceLastAccessedDetail must be used by the same role within a session, or by the same user when used to call GetServiceLastAccessedDetail.

  • httpStatus :: Int

    The response's http status code.

Instances

Instances details
Eq GenerateServiceLastAccessedDetailsResponse Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

Read GenerateServiceLastAccessedDetailsResponse Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

Show GenerateServiceLastAccessedDetailsResponse Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

Generic GenerateServiceLastAccessedDetailsResponse Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

NFData GenerateServiceLastAccessedDetailsResponse Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

type Rep GenerateServiceLastAccessedDetailsResponse Source # 
Instance details

Defined in Amazonka.IAM.GenerateServiceLastAccessedDetails

type Rep GenerateServiceLastAccessedDetailsResponse = D1 ('MetaData "GenerateServiceLastAccessedDetailsResponse" "Amazonka.IAM.GenerateServiceLastAccessedDetails" "libZSservicesZSamazonka-iamZSamazonka-iam" 'False) (C1 ('MetaCons "GenerateServiceLastAccessedDetailsResponse'" 'PrefixI 'True) (S1 ('MetaSel ('Just "jobId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "httpStatus") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Int)))

newGenerateServiceLastAccessedDetailsResponse Source #

Create a value of GenerateServiceLastAccessedDetailsResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:jobId:GenerateServiceLastAccessedDetailsResponse', generateServiceLastAccessedDetailsResponse_jobId - The JobId that you can use in the GetServiceLastAccessedDetails or GetServiceLastAccessedDetailsWithEntities operations. The JobId returned by GenerateServiceLastAccessedDetail must be used by the same role within a session, or by the same user when used to call GetServiceLastAccessedDetail.

$sel:httpStatus:GenerateServiceLastAccessedDetailsResponse', generateServiceLastAccessedDetailsResponse_httpStatus - The response's http status code.

Response Lenses

generateServiceLastAccessedDetailsResponse_jobId :: Lens' GenerateServiceLastAccessedDetailsResponse (Maybe Text) Source #

The JobId that you can use in the GetServiceLastAccessedDetails or GetServiceLastAccessedDetailsWithEntities operations. The JobId returned by GenerateServiceLastAccessedDetail must be used by the same role within a session, or by the same user when used to call GetServiceLastAccessedDetail.