Amazon IAM Iam Service Last Accessed Detail API

openapi: 3.2.0
info:
  title: AWS Identity and Access Management Service Last Accessed…
  version: '2010-05-08'
  description: Generated from AWS's published Smithy model for AWS Identity and Access Management. 3 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://iam.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Service Last Accessed Detail
paths:
  /?Action=GenerateServiceLastAccessedDetails:
    post:
      operationId: GenerateServiceLastAccessedDetails
      summary: Generate Service Last Accessed Details
      description: Generates a report that includes details about when an IAM resource (user, group, role, or policy) was last used in an attempt to access Amazon Web Services services. Recent activity usually appears within four hours. IAM reports activity for at least the last 400 days, or less if your Region began supporting this feature within the last year. For more information, see Regions where data is tracked. For more information about services and actions for which action last accessed information is displayed, see IAM action last accessed information services and actions. The service last accessed data includes all attempts to access an Amazon Web Services API, not just the successful ones. This includes all attempts that were made using the Amazon Web Services Management Console, the Amazon Web Services API through any of the SDKs, or any of the command line tools. An unexpected entry in the service last accessed data does not mean that your account has been compromised, because the request might have been denied. Refer to your CloudTrail logs as the authoritative source for information about all API calls and whether they were successful or denied access. For more information, see Loggin
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/GenerateServiceLastAccessedDetailsResponse'
              example:
                JobId: examplef-1305-c245-eba4-71fe298bcda7
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: GenerateServiceLastAccessedDetails
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/GenerateServiceLastAccessedDetailsRequest'
            example:
              Arn: arn:aws:iam::123456789012:policy/ExamplePolicy1
      tags:
      - Service Last Accessed Detail
  /?Action=GetServiceLastAccessedDetails:
    post:
      operationId: GetServiceLastAccessedDetails
      summary: Get Service Last Accessed Details
      description: Retrieves a service last accessed report that was created using the GenerateServiceLastAccessedDetails operation. You can use the JobId parameter in GetServiceLastAccessedDetails to retrieve the status of your report job. When the report is complete, you can retrieve the generated report. The report includes a list of Amazon Web Services services that the resource (user, group, role, or managed policy) can access. Service last accessed data does not use other policy types when determining whether a resource could access a service. These other policy types include resource-based policies, access control lists, Organizations policies, IAM permissions boundaries, and STS assume role policies. It only applies permissions policy logic. For more about the evaluation of policy types, see Evaluating policies in the IAM User Guide. For each service that the resource could access using permissions policies, the operation returns details about the most recent access attempt. If there was no attempt, the service is listed without details about the most recent attempt to access the service. If the operation fails, the GetServiceLastAccessedDetails operation returns the reason that it failed. Th
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/GetServiceLastAccessedDetailsResponse'
              example:
                JobStatus: COMPLETED
                JobCreationDate: '2018-10-24T19:47:31.466Z'
                ServicesLastAccessed:
                - TotalAuthenticatedEntities: 2
                  LastAuthenticated: '2018-10-24T19:11:00Z'
                  ServiceNamespace: iam
                  LastAuthenticatedEntity: arn:aws:iam::123456789012:user/AWSExampleUser01
                  ServiceName: AWS Identity and Access Management
                - TotalAuthenticatedEntities: 0
                  ServiceNamespace: s3
                  ServiceName: Amazon Simple Storage Service
                JobCompletionDate: '2018-10-24T19:47:35.241Z'
                IsTruncated: false
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: GetServiceLastAccessedDetails
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/GetServiceLastAccessedDetailsRequest'
            example:
              JobId: examplef-1305-c245-eba4-71fe298bcda7
      tags:
      - Service Last Accessed Detail
  /?Action=GetServiceLastAccessedDetailsWithEntities:
    post:
      operationId: GetServiceLastAccessedDetailsWithEntities
      summary: Get Service Last Accessed Details With Entities
      description: After you generate a group or policy report using the GenerateServiceLastAccessedDetails operation, you can use the JobId parameter in GetServiceLastAccessedDetailsWithEntities. This operation retrieves the status of your report job and a list of entities that could have used group or policy permissions to access the specified service. Group – For a group report, this operation returns a list of users in the group that could have used the group’s policies in an attempt to access the service. Policy – For a policy report, this operation returns a list of entities (users or roles) that could have used the policy in an attempt to access the service. You can also use this operation for user or role reports to retrieve details about those entities. If the operation fails, the GetServiceLastAccessedDetailsWithEntities operation returns the reason that it failed. By default, the list of associated entities is sorted by date, with the most recent access listed first.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/GetServiceLastAccessedDetailsWithEntitiesResponse'
              example:
                JobStatus: COMPLETED
                JobCreationDate: '2018-10-24T19:47:31.466Z'
                JobCompletionDate: '2018-10-24T19:47:35.241Z'
                EntityDetailsList:
                - EntityInfo:
                    Id: AIDAEX2EXAMPLEB6IGCDC
                    Name: AWSExampleUser01
                    Type: USER
                    Path: /
                    Arn: arn:aws:iam::123456789012:user/AWSExampleUser01
                  LastAuthenticated: '2018-10-24T19:10:00Z'
                - EntityInfo:
                    Id: AROAEAEXAMPLEIANXSIU4
                    Name: AWSExampleRole01
                    Type: ROLE
                    Path: /
                    Arn: arn:aws:iam::123456789012:role/AWSExampleRole01
                IsTruncated: false
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: GetServiceLastAccessedDetailsWithEntities
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/GetServiceLastAccessedDetailsWithEntitiesRequest'
            example:
              JobId: examplef-1305-c245-eba4-71fe298bcda7
              ServiceNamespace: iam
      tags:
      - Service Last Accessed Detail
components:
  schemas:
    ErrorDetails:
      type: object
      properties:
        Message:
          type: string
          description: Detailed information about the reason that the operation failed.
        Code:
          type: string
          description: The error code associated with the operation failure.
      required:
      - Message
      - Code
    GetServiceLastAccessedDetailsRequest:
      type: object
      properties:
        JobId:
          type: string
          description: The ID of the request generated by the GenerateServiceLastAccessedDetails operation. The JobId returned by GenerateServiceLastAccessedDetail must be used by the same role within a session, or by the same user when used to call GetServiceLastAccessedDetail.
        MaxItems:
          type: integer
          description: Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true. If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
        Marker:
          type: string
          description: Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
      required:
      - JobId
    TrackedActionLastAccessed:
      type: object
      properties:
        ActionName:
          type: string
          description: The name of the tracked action to which access was attempted. Tracked actions are actions that report activity to IAM.
        LastAccessedEntity:
          type: string
        LastAccessedTime:
          type: string
          format: date-time
          description: The date and time, in ISO 8601 date-time format, when an authenticated entity most recently attempted to access the tracked service. Amazon Web Services does not report unauthenticated requests. This field is null if no IAM entities attempted to access the service within the tracking period.
        LastAccessedRegion:
          type: string
          description: The Region from which the authenticated entity (user or role) last attempted to access the tracked action. Amazon Web Services does not report unauthenticated requests. This field is null if no IAM entities attempted to access the service within the tracking period.
    GenerateServiceLastAccessedDetailsRequest:
      type: object
      properties:
        Arn:
          type: string
          description: The ARN of the IAM resource (user, group, role, or managed policy) used to generate information about when the resource was last used in an attempt to access an Amazon Web Services service.
        Granularity:
          type: string
          enum:
          - SERVICE_LEVEL
          - ACTION_LEVEL
          description: The level of detail that you want to generate. You can specify whether you want to generate information about the last attempt to access services or actions. If you specify service-level granularity, this operation generates only service data. If you specify action-level granularity, it generates service and action data. If you don't include this optional parameter, the operation generates service data.
      required:
      - Arn
    GetServiceLastAccessedDetailsResponse:
      type: object
      properties:
        JobStatus:
          type: string
          enum:
          - IN_PROGRESS
          - COMPLETED
          - FAILED
          description: The status of the job.
        JobType:
          type: string
          enum:
          - SERVICE_LEVEL
          - ACTION_LEVEL
          description: The type of job. Service jobs return information about when each service was last accessed. Action jobs also include information about when tracked actions within the service were last accessed.
        JobCreationDate:
          type: string
          format: date-time
          description: The date and time, in ISO 8601 date-time format, when the report job was created.
        ServicesLastAccessed:
          type: array
          items:
            $ref: '#/components/schemas/ServiceLastAccessed'
          description: A ServiceLastAccessed object that contains details about the most recent attempt to access the service.
        JobCompletionDate:
          type: string
          format: date-time
          description: The date and time, in ISO 8601 date-time format, when the generated report job was completed or failed. This field is null if the job is still in progress, as indicated by a job status value of IN_PROGRESS.
        IsTruncated:
          type: boolean
          description: A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
        Marker:
          type: string
          description: When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
        Error:
          $ref: '#/components/schemas/ErrorDetails'
      required:
      - JobStatus
      - JobCreationDate
      - ServicesLastAccessed
      - JobCompletionDate
    NoSuchEntityException:
      type: object
      properties:
        message:
          type: string
    EntityInfo:
      type: object
      properties:
        Arn:
          type: string
        Name:
          type: string
          description: The name of the entity (user or role).
        Type:
          type: string
          enum:
          - USER
          - ROLE
          - GROUP
          description: The type of entity (user or role).
        Id:
          type: string
          description: The identifier of the entity (user or role).
        Path:
          type: string
          description: The path to the entity (user or role). For more information about paths, see IAM identifiers in the IAM User Guide.
      required:
      - Arn
      - Name
      - Type
      - Id
    GetServiceLastAccessedDetailsWithEntitiesResponse:
      type: object
      properties:
        JobStatus:
          type: string
          enum:
          - IN_PROGRESS
          - COMPLETED
          - FAILED
          description: The status of the job.
        JobCreationDate:
          type: string
          format: date-time
          description: The date and time, in ISO 8601 date-time format, when the report job was created.
        JobCompletionDate:
          type: string
          format: date-time
          description: The date and time, in ISO 8601 date-time format, when the generated report job was completed or failed. This field is null if the job is still in progress, as indicated by a job status value of IN_PROGRESS.
        EntityDetailsList:
          type: array
          items:
            $ref: '#/components/schemas/EntityDetails'
          description: An EntityDetailsList object that contains details about when an IAM entity (user or role) used group or policy permissions in an attempt to access the specified Amazon Web Services service.
        IsTruncated:
          type: boolean
          description: A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
        Marker:
          type: string
          description: When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
        Error:
          $ref: '#/components/schemas/ErrorDetails'
      required:
      - JobStatus
      - JobCreationDate
      - JobCompletionDate
      - EntityDetailsList
    GenerateServiceLastAccessedDetailsResponse:
      type: object
      properties:
        JobId:
          type: string
          description: The JobId that you can use in the GetServiceLastAccessedDetails or GetServiceLastAccessedDetailsWithEntities operations. The JobId returned by GenerateServiceLastAccessedDetail must be used by the same role within a session, or by the same user when used to call GetServiceLastAccessedDetail.
    InvalidInputException:
      type: object
      properties:
        message:
          type: string
    ServiceLastAccessed:
      type: object
      properties:
        ServiceName:
          type: string
          description: The name of the service in which access was attempted.
        LastAuthenticated:
          type: string
          format: date-time
          description: The date and time, in ISO 8601 date-time format, when an authenticated entity most recently attempted to access the service. Amazon Web Services does not report unauthenticated requests. This field is null if no IAM entities attempted to access the service within the tracking period.
        ServiceNamespace:
          type: string
          description: 'The namespace of the service in which access was attempted. To learn the service namespace of a service, see Actions, resources, and condition keys for Amazon Web Services services in the Service Authorization Reference. Choose the name of the service to view details for that service. In the first paragraph, find the service prefix. For example, (service prefix: a4b). For more information about service namespaces, see Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.'
        LastAuthenticatedEntity:
          type: string
          description: The ARN of the authenticated entity (user or role) that last attempted to access the service. Amazon Web Services does not report unauthenticated requests. This field is null if no IAM entities attempted to access the service within the tracking period.
        LastAuthenticatedRegion:
          type: string
          description: The Region from which the authenticated entity (user or role) last attempted to access the service. Amazon Web Services does not report unauthenticated requests. This field is null if no IAM entities attempted to access the service within the tracking period.
        TotalAuthenticatedEntities:
          type: integer
          description: The total number of authenticated principals (root user, IAM users, or IAM roles) that have attempted to access the service. This field is null if no principals attempted to access the service within the tracking period.
        TrackedActionsLastAccessed:
          type: array
          items:
            $ref: '#/components/schemas/TrackedActionLastAccessed'
          description: An object that contains details about the most recent attempt to access a tracked action within the service. This field is null if there no tracked actions or if the principal did not use the tracked actions within the tracking period. This field is also null if the report was generated at the service level and not the action level. For more information, see the Granularity field in GenerateServiceLastAccessedDetails.
      required:
      - ServiceName
      - ServiceNamespace
    EntityDetails:
      type: object
      properties:
        EntityInfo:
          $ref: '#/components/schemas/EntityInfo'
        LastAuthenticated:
          type: string
          format: date-time
          description: The date and time, in ISO 8601 date-time format, when the authenticated entity last attempted to access Amazon Web Services. Amazon Web Services does not report unauthenticated requests. This field is null if no IAM entities attempted to access the service within the tracking period.
      required:
      - EntityInfo
    GetServiceLastAccessedDetailsWithEntitiesRequest:
      type: object
      properties:
        JobId:
          type: string
          description: The ID of the request generated by the GenerateServiceLastAccessedDetails operation.
        ServiceNamespace:
          type: string
          description: 'The service namespace for an Amazon Web Services service. Provide the service namespace to learn when the IAM entity last attempted to access the specified service. To learn the service namespace for a service, see Actions, resources, and condition keys for Amazon Web Services services in the IAM User Guide. Choose the name of the service to view details for that service. In the first paragraph, find the service prefix. For example, (service prefix: a4b). For more information about service namespaces, see Amazon Web Services service namespaces in the Amazon Web Services General Reference.'
        MaxItems:
          type: integer
          description: Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true. If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
        Marker:
          type: string
          description: Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
      required:
      - JobId
      - ServiceNamespace
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: iam
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/iam/service/2010-05-08/iam-2010-05-08.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)