For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/ddsql_reference/data_directory/aws/aws.iam_credential_report.dataset.md. A documentation index is available at /llms.txt.

IAM Credential Report

An IAM credential report entry describes the password, access key, MFA device, and signing certificate status for one IAM user or the AWS account root user.

aws.iam_credential_report

Fields

TitleIDTypeData TypeDescription
_keycorestring
access_key_1_activecoreboolIndicates whether the first access key exists and has an Active status.
access_key_1_last_rotatedcoretimestampThe date and time when the first access key was created or last changed.
access_key_1_last_used_datecoretimestampThe date and time when the first access key was most recently used to sign an AWS API request.
access_key_1_last_used_regioncorestringThe AWS Region in which the first access key was most recently used.
access_key_1_last_used_servicecorestringThe AWS service most recently accessed with the first access key.
access_key_2_activecoreboolIndicates whether the second access key exists and has an Active status.
access_key_2_last_rotatedcoretimestampThe date and time when the second access key was created or last changed.
access_key_2_last_used_datecoretimestampThe date and time when the second access key was most recently used to sign an AWS API request.
access_key_2_last_used_regioncorestringThe AWS Region in which the second access key was most recently used.
access_key_2_last_used_servicecorestringThe AWS service most recently accessed with the second access key.
account_idcorestringThe ID of the AWS account represented by this credential report entry.
arncorestringThe Amazon Resource Name of the IAM user or AWS account root user represented by the report entry.
cert_1_activecoreboolIndicates whether the first X.509 signing certificate exists and has an Active status.
cert_1_last_rotatedcoretimestampThe date and time when the first signing certificate was created or last changed.
cert_2_activecoreboolIndicates whether the second X.509 signing certificate exists and has an Active status.
cert_2_last_rotatedcoretimestampThe date and time when the second signing certificate was created or last changed.
mfa_activecoreboolIndicates whether a multi-factor authentication device is enabled for the user.
password_enabledcoreboolIndicates whether the user has a password that can be used to sign in to AWS websites.
password_last_changedcoretimestampThe date and time when the user's password was last set.
password_last_usedcoretimestampThe date and time when the user's password was last used to sign in to an AWS website.
password_next_rotationcoretimestampThe date and time when the user is required to set a new password under the account password policy.
tagscorehstore_csv
usercorestringThe IAM user name, or <root_account> for the AWS account root user.
user_creation_timecoretimestampThe date and time when the IAM user was created.