AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.
Retrieves a service last accessed report that was created using the
Service last accessed data does not use other policy types when determining whether
a resource could access a service. These other policy types include resource-based
policies, access control lists, Organizations policies, IAM permissions boundaries,
and STS assume role policies. It only applies permissions policy logic. For more about
the evaluation of policy types, see Evaluating
policies in the IAM User Guide.
GenerateServiceLastAccessedDetails
operation. You can use the JobId parameter in GetServiceLastAccessedDetails
to retrieve the status of your report job. When the report is complete, you can retrieve
the generated report. The report includes a list of Amazon Web Services services that
the resource (user, group, role, or managed policy) can access.
For each service that the resource could access using permissions policies, the operation
returns details about the most recent access attempt. If there was no attempt, the
service is listed without details about the most recent attempt to access the service.
If the operation fails, the GetServiceLastAccessedDetails operation returns
the reason that it failed.
The GetServiceLastAccessedDetails operation returns a list of services. This
list includes the number of entities that have attempted to access the service and
the date and time of the last attempt. It also returns the ARN of the following entity,
depending on the resource ARN that you used to generate the report:
User – Returns the user ARN that you used to generate the report
Group – Returns the ARN of the group member (user) that last attempted to access the service
Role – Returns the role ARN that you used to generate the report
Policy – Returns the ARN of the user or role that last used the policy to attempt to access the service
By default, the list is sorted by service namespace.
If you specified ACTION_LEVEL granularity when you generated the report, this
operation returns service and action last accessed data. This includes the most recent
access attempt for each tracked action within a service. Otherwise, this operation
returns only service data.
For more information about service and action last accessed data, see Reducing permissions using service last accessed data in the IAM User Guide.
For .NET Core this operation is only available in asynchronous form. Please refer to GetServiceLastAccessedDetailsAsync.
Namespace: Amazon.IdentityManagement
Assembly: AWSSDK.IdentityManagement.dll
Version: 3.x.y.z
public virtual GetServiceLastAccessedDetailsResponse GetServiceLastAccessedDetails( GetServiceLastAccessedDetailsRequest request )
Container for the necessary parameters to execute the GetServiceLastAccessedDetails service method.
| Exception | Condition |
|---|---|
| InvalidInputException | The request was rejected because an invalid or out-of-range value was supplied for an input parameter. |
| NoSuchEntityException | The request was rejected because it referenced a resource entity that does not exist. The error message describes the resource. |
The following operation gets details about the report with the job ID: examplef-1305-c245-eba4-71fe298bcda7
var client = new AmazonIdentityManagementServiceClient();
var response = client.GetServiceLastAccessedDetails(new GetServiceLastAccessedDetailsRequest
{
JobId = "examplef-1305-c245-eba4-71fe298bcda7"
});
bool isTruncated = response.IsTruncated;
DateTime jobCompletionDate = response.JobCompletionDate;
DateTime jobCreationDate = response.JobCreationDate;
string jobStatus = response.JobStatus;
List<ServiceLastAccessed> servicesLastAccessed = response.ServicesLastAccessed;
.NET Framework:
Supported in: 4.5 and newer, 3.5