1). Create a new key in IAM console
2). use Cloud Trail to log the use of the old key
Go to the CloudTrail console.
Click Trails > Create trail.
Name your trail (e.g., AllAPIUsageTrail).
Choose “Apply trail to all regions”.
Enable management events (this covers most IAM and API activity). Optionally include data events for S3, Lambda, etc.
Configure S3 bucket for log storage. CloudTrail will write logs in a structured folder per region/date.
3). Use Athena to query the logs
Go to the Athena Console
Hamburger menu > Query Editor
You will have a warning to set the result location > set this to a S3 bucket
Click Settings > Manage > Browse S3 > Set a bucket
Save
In the editor query the data
1 2 3 4 5 6 7 8 9 10 11 12 | SELECT eventtime, eventsource, eventname, awsregion, sourceipaddress, useragent, errorcode, errormessage FROM "default"."cloudtrail_logs_aws_cloudtrail_logs_9999999999_4417cf5b_scripts_user_api" WHERE useridentity.accesskeyid = 'AK...' ORDER BY eventtime DESC; |