---
title: IAM Credential Report
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > DDSQL Reference > Data Directory > IAM Credential Report
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM Credential Report

An IAM credential report entry describes the password, access key, MFA device, and signing certificate status for one IAM user or the AWS account root user.

```
aws.iam_credential_report
```

## Fields

| Title                          | ID   | Type       | Data Type                                                                                            | Description |
| ------------------------------ | ---- | ---------- | ---------------------------------------------------------------------------------------------------- | ----------- |
| _key                           | core | string     |
| access_key_1_active            | core | bool       | Indicates whether the first access key exists and has an Active status.                              |
| access_key_1_last_rotated      | core | timestamp  | The date and time when the first access key was created or last changed.                             |
| access_key_1_last_used_date    | core | timestamp  | The date and time when the first access key was most recently used to sign an AWS API request.       |
| access_key_1_last_used_region  | core | string     | The AWS Region in which the first access key was most recently used.                                 |
| access_key_1_last_used_service | core | string     | The AWS service most recently accessed with the first access key.                                    |
| access_key_2_active            | core | bool       | Indicates whether the second access key exists and has an Active status.                             |
| access_key_2_last_rotated      | core | timestamp  | The date and time when the second access key was created or last changed.                            |
| access_key_2_last_used_date    | core | timestamp  | The date and time when the second access key was most recently used to sign an AWS API request.      |
| access_key_2_last_used_region  | core | string     | The AWS Region in which the second access key was most recently used.                                |
| access_key_2_last_used_service | core | string     | The AWS service most recently accessed with the second access key.                                   |
| account_id                     | core | string     | The ID of the AWS account represented by this credential report entry.                               |
| arn                            | core | string     | The Amazon Resource Name of the IAM user or AWS account root user represented by the report entry.   |
| cert_1_active                  | core | bool       | Indicates whether the first X.509 signing certificate exists and has an Active status.               |
| cert_1_last_rotated            | core | timestamp  | The date and time when the first signing certificate was created or last changed.                    |
| cert_2_active                  | core | bool       | Indicates whether the second X.509 signing certificate exists and has an Active status.              |
| cert_2_last_rotated            | core | timestamp  | The date and time when the second signing certificate was created or last changed.                   |
| mfa_active                     | core | bool       | Indicates whether a multi-factor authentication device is enabled for the user.                      |
| password_enabled               | core | bool       | Indicates whether the user has a password that can be used to sign in to AWS websites.               |
| password_last_changed          | core | timestamp  | The date and time when the user's password was last set.                                             |
| password_last_used             | core | timestamp  | The date and time when the user's password was last used to sign in to an AWS website.               |
| password_next_rotation         | core | timestamp  | The date and time when the user is required to set a new password under the account password policy. |
| tags                           | core | hstore_csv |
| user                           | core | string     | The IAM user name, or <root_account> for the AWS account root user.                                  |
| user_creation_time             | core | timestamp  | The date and time when the IAM user was created.                                                     |