Pulls all User IAM accounts ACTIVE Access keys that are over a set days since used. And checks the Access Keys details. This will skip Disabled Keys. #Public #AWS #Security #IAM #Inventory

active_aws_access_keys_Details.ps1

# active_aws_access_keys_Details.ps1
<#
Description: Pulls user IAM accounts ACTIVE Access keys that are older than a set number of days since used and Create Days is older than a set amount. And gets the Access Keys details. This will skip Disabled Keys.
Can be used to find keys older than a set amount of days and not used in a set amount of days so they can be disabled.
Written: Ed Walsh
PowerShell.Core tested: Not Tested
Version: 1.0.2
Create Date: 11/5/2021
Revised Date: 11/7/2021
#>
$Out = @()

#Filter on Access Keys not used in this many days.
[int]$targetInActiveDays = 90

#Filter on Access Keys created more than this many days.
[int]$targetCreateDays = 180


$IamUserNames = (Get-IAMUserList).UserName

foreach ($IamUserName in $IamUserNames)

{
$keys = Get-IAMAccessKey -UserName $IamUserName | where Status -eq 'Active'
 
 foreach ($key in $Keys) {

$o = New-Object -TypeName System.Management.Automation.PSObject -Property ([ordered]@{
    
            'User_Name' = $key.UserName;
            'AccessKey'= $key.AccessKeyId;
            'Create_Date'       = $key.CreateDate;
            'Days_created' = [int](New-TimeSpan -Start $key.CreateDate -End $(Get-Date)).days;
            'Status' = $key.Status;
            'Ever_Used' = If ( ((Get-IAMAccessKeyLastUsed -AccessKeyID $key.AccessKeyId).AccessKeyLastUsed.ServiceName ) -eq 'N/A') {'No'} Else {'Yes'};
            'LastUsed' = (Get-IAMAccessKeyLastUsed -AccessKeyID $key.AccessKeyId).AccessKeyLastUsed.LastUsedDate;
            'Service_Last_Used' = (Get-IAMAccessKeyLastUsed -AccessKeyID $key.AccessKeyId).AccessKeyLastUsed.ServiceName ;
            'Region' = (Get-IAMAccessKeyLastUsed -AccessKeyID $key.AccessKeyId).AccessKeyLastUsed.Region ;
            'Days_Since_Used' = [int](New-TimeSpan -Start ((Get-IAMAccessKeyLastUsed -AccessKeyID $key.AccessKeyId).AccessKeyLastUsed.LastUsedDate) -End $(Get-Date)).days;
            
   
                       
    }
     ) 

     $out += $o | where {($_.Days_Since_Used -gt $targetInActiveDays) -and ($_.Days_created -gt $targetCreateDays)}

 }
 }
 $out

 <# You can build this out further by entering below here what to do with $out.
 Do you Email the list to a Distrubution Mailing List?
 Do you set the entries in $out to disable the Access keys?
  #>