AWS IAM Commands

验证：未记录

适用版本: 未记录
验证范围: 尚未登记验证记录。

本文缩写（英文全称与中文含义）

缩写	英文全称／名称	中文含义
API	Application Programming Interface	应用程序编程接口
AWS	Amazon Web Services	亚马逊云服务
CD	Continuous Delivery / Continuous Deployment	持续交付／持续部署；是否自动上线取决于流程
CI	Continuous Integration	持续集成
CLI	Command-Line Interface	命令行接口
IAM	Identity and Access Management	身份与访问管理
ID	Identifier	标识符
OIDC	OpenID Connect	基于 OAuth 2.0 的身份认证协议
SSO	Single Sign-On	单点登录
STS	Security Token Service	安全令牌服务，用于签发或交换短期凭据

Links#

1. Find Owner And Creator From Access Key ID#

可以通过 access key ID 查到它属于哪个 IAM user，但“属于谁”和“谁创建的”是两个问题。

owner:
    this access key belongs to which IAM user
    use IAM GetAccessKeyLastUsed

creator:
    which principal called CreateAccessKey
    use CloudTrail CreateAccessKey event

Find owner:

export ACCESS_KEY_ID="AKIAxxxxxxxxxxxxxxxx"

aws iam get-access-key-last-used --access-key-id "$ACCESS_KEY_ID" --query '{UserName:UserName,LastUsed:AccessKeyLastUsed}' --output json

Typical output:

{
  "UserName": "deploy-user",
  "LastUsed": {
    "LastUsedDate": "2026-05-31T08:12:00+00:00",
    "ServiceName": "s3",
    "Region": "ap-east-1"
  }
}

Notes:

works for:
    long-lived IAM user access key

does not answer:
    who created the key
    which human used an assumed role
    temporary STS key owner, for example ASIA...

requires:
    iam:GetAccessKeyLastUsed

Find creator from recent CloudTrail management events:

export ACCESS_KEY_ID="AKIAxxxxxxxxxxxxxxxx"
export REGION="us-east-1"

aws cloudtrail lookup-events --region "$REGION" --lookup-attributes AttributeKey=EventName,AttributeValue=CreateAccessKey --query 'Events[].CloudTrailEvent' --output text |
jq -r --arg ak "$ACCESS_KEY_ID" '
  fromjson
  | select(.responseElements.accessKey.accessKeyId == $ak)
  | {
      eventTime,
      creatorArn: .userIdentity.arn,
      creatorType: .userIdentity.type,
      createdUser: .requestParameters.userName,
      accessKeyId: .responseElements.accessKey.accessKeyId,
      sourceIPAddress,
      userAgent
    }
'

If CloudTrail Event history is not enough:

CloudTrail Event history 是按 Region 查询的近期管理事件视图，不能当作完整的长期或数据访问审计；集中留存需另配 trail / Lake。

CloudTrail Event history:
    only recent management events, Region by Region
    good for quick investigation

organization trail / CloudTrail Lake:
    required for older events and central audit
    search all accounts and all regions from security/log account

common pitfall:
    lookup by AttributeKey=AccessKeyId means the access key used to sign the API call
    it is not necessarily the newly created access key in responseElements

Incident response:

aws iam update-access-key --user-name "<UserNameFromGetAccessKeyLastUsed>" --access-key-id "$ACCESS_KEY_ID" --status Inactive

Then review CloudTrail events signed by this key:

aws cloudtrail lookup-events --region "$REGION" --lookup-attributes AttributeKey=AccessKeyId,AttributeValue="$ACCESS_KEY_ID" --max-items 50

Production rule:

prod:
    no IAM user access key
    no human long-lived access key
    CI/CD uses OIDC assume role
    emergency access uses break-glass SSO role