{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/", "item": { "id": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/", "slug": "interpret-iam-last-accessed-records-as-attempts-with-coverage-limits", "url": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits.md", "json": "https://update.dsesecurity.com/api/v1/posts/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/" }, "title": "Interpret IAM last-accessed records as attempts with coverage limits", "summary": "Use access history to investigate permissions without equating every entry with success.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:33+00:00", "modified_at": "2026-10-20T18:34:28+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 246, "potentially_affected": "This applies when reviewing IAM permissions using last-accessed reports, especially before removing apparently unused permissions.", "dse_recommendation": "DSE recommends recording the report scope and collection period before interpreting an entry.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Use access history to investigate permissions without equating every entry with success.

\n

Source facts

\n

IAM service last-accessed information includes attempted API access, including denied attempts. Action-level history covers supported management actions rather than data-plane events, and iam:PassRole is not tracked there. AWS directs administrators to CloudTrail for evidence about API calls and whether they succeeded or were denied.

\n

Source: AWS Documentation.

\n

Applicability

\n

This applies when reviewing IAM permissions using last-accessed reports, especially before removing apparently unused permissions.

\n

DSE recommendation

\n

DSE recommends recording the report scope and collection period before interpreting an entry. Correlate unexpected activity with the relevant audit event instead of treating it as proof of successful access or compromise. Ask application owners about periodic, recovery and emergency operations before narrowing a policy. Keep a proposed removal small enough to validate, with the prior policy available. Document known coverage gaps so a later reviewer does not interpret absence in this report as evidence that a capability is unnecessary. Label every proposed removal with the evidence available and the important operation still needing owner confirmation. Keep infrequent disaster-recovery actions in a separate review queue so a quiet reporting period does not become the sole reason to remove them.

\n

Verification

\n

Proposed verification: compare a selected last-accessed entry with its audit evidence and confirm the action is within documented coverage. Pilot any approved permission removal against normal and recovery workflows. Retain the owner decision and observed behavior with the revised policy.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Use access history to investigate permissions without equating every entry with success.\nSource facts\nIAM service last-accessed information includes attempted API access, including denied attempts. Action-level history covers supported management actions rather than data-plane events, and iam:PassRole is not tracked there. AWS directs administrators to CloudTrail for evidence about API calls and whether they succeeded or were denied.\nSource: AWS Documentation.\nApplicability\nThis applies when reviewing IAM permissions using last-accessed reports, especially before removing apparently unused permissions.\nDSE recommendation\nDSE recommends recording the report scope and collection period before interpreting an entry. Correlate unexpected activity with the relevant audit event instead of treating it as proof of successful access or compromise. Ask application owners about periodic, recovery and emergency operations before narrowing a policy. Keep a proposed removal small enough to validate, with the prior policy available. Document known coverage gaps so a later reviewer does not interpret absence in this report as evidence that a capability is unnecessary. Label every proposed removal with the evidence available and the important operation still needing owner confirmation. Keep infrequent disaster-recovery actions in a separate review queue so a quiet reporting period does not become the sole reason to remove them.\nVerification\nProposed verification: compare a selected last-accessed entry with its audit evidence and confirm the action is within documented coverage. Pilot any approved permission removal against normal and recovery workflows. Retain the owner decision and observed behavior with the revised policy.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Use access history to investigate permissions without equating every entry with success.\n\n## Source facts\n\nIAM service last-accessed information includes attempted API access, including denied attempts. Action-level history covers supported management actions rather than data-plane events, and iam:PassRole is not tracked there. AWS directs administrators to CloudTrail for evidence about API calls and whether they succeeded or were denied.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html).\n\n## Applicability\n\nThis applies when reviewing IAM permissions using last-accessed reports, especially before removing apparently unused permissions.\n\n## DSE recommendation\n\nDSE recommends recording the report scope and collection period before interpreting an entry. Correlate unexpected activity with the relevant audit event instead of treating it as proof of successful access or compromise. Ask application owners about periodic, recovery and emergency operations before narrowing a policy. Keep a proposed removal small enough to validate, with the prior policy available. Document known coverage gaps so a later reviewer does not interpret absence in this report as evidence that a capability is unnecessary. Label every proposed removal with the evidence available and the important operation still needing owner confirmation. Keep infrequent disaster-recovery actions in a separate review queue so a quiet reporting period does not become the sole reason to remove them.\n\n## Verification\n\nProposed verification: compare a selected last-accessed entry with its audit evidence and confirm the action is within documented coverage. Pilot any approved permission removal against normal and recovery workflows. Retain the owner decision and observed behavior with the revised policy.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/", "url": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Interpret IAM last-accessed records as attempts with coverage limits", "item": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/#article", "identifier": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/", "url": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/", "headline": "Interpret IAM last-accessed records as attempts with coverage limits", "description": "Use access history to investigate permissions without equating every entry with success.", "abstract": "Use access history to investigate permissions without equating every entry with success.", "articleBody": "Use access history to investigate permissions without equating every entry with success.\nSource facts\nIAM service last-accessed information includes attempted API access, including denied attempts. Action-level history covers supported management actions rather than data-plane events, and iam:PassRole is not tracked there. AWS directs administrators to CloudTrail for evidence about API calls and whether they succeeded or were denied.\nSource: AWS Documentation.\nApplicability\nThis applies when reviewing IAM permissions using last-accessed reports, especially before removing apparently unused permissions.\nDSE recommendation\nDSE recommends recording the report scope and collection period before interpreting an entry. Correlate unexpected activity with the relevant audit event instead of treating it as proof of successful access or compromise. Ask application owners about periodic, recovery and emergency operations before narrowing a policy. Keep a proposed removal small enough to validate, with the prior policy available. Document known coverage gaps so a later reviewer does not interpret absence in this report as evidence that a capability is unnecessary. Label every proposed removal with the evidence available and the important operation still needing owner confirmation. Keep infrequent disaster-recovery actions in a separate review queue so a quiet reporting period does not become the sole reason to remove them.\nVerification\nProposed verification: compare a selected last-accessed entry with its audit evidence and confirm the action is within documented coverage. Pilot any approved permission removal against normal and recovery workflows. Retain the owner decision and observed behavior with the revised policy.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:33+00:00", "dateModified": "2026-10-20T18:34:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/interpret-iam-last-accessed-records-as-attempts-with-coverage-limits/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Interpret IAM last-accessed records as attempts with coverage limits" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 246, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" } } ] } }