Use Access Analyzer’s UNUSED_IAM_CREDENTIAL findings together with the AWS CLI or SDK to enumerate, filter, and delete stale access keys, console passwords, and X.509 certificates.
1. Enable IAM Access Analyzer – in the console or via CLI:
```bash
aws accessanalyzer create-analyzer --analyzer-name org-analyzer --type ACCOUNT
```
2. List unused‑credential findings (default looks back 90 days):
```bash
aws accessanalyzer list-findings \
--analyzer-name org-analyzer \
--type UNUSED_IAM_CREDENTIAL \
--query 'findings[?resourceType==AWS::IAM::User && lastUsedDate<2026-05-01]' \
--output json > findings.json
```
3. Extract IDs with jq (example filters >90 days):
```bash
jq -r '.[] | select(.lastUsedDate < (now - 90246060)) | .resourceId' findings.json > stale.txt
```
4. Revoke each credential – loop over stale.txt:
```bash
while read user; do
# Access keys
aws iam list-access-keys --user-name "$user" --query 'AccessKeyMetadata[?Status==Active].AccessKeyId' -o text | \
xargs -n1 -I{} aws iam delete-access-key --user-name "$user" --access-key-id {}
# Console password
aws iam delete-login-profile --user-name "$user" || true
# X.509 service‑specific credential (example for CodeCommit)
aws iam list-service-specific-credentials --user-name "$user" --service-name codecommit.amazonaws.com \
--query 'ServiceSpecificCredentials[?Status==Active].ServiceSpecificCredentialId' -o text | \
xargs -n1 -I{} aws iam delete-service-specific-credential --user-name "$user" --service-specific-credential-id {}
done < stale.txt
```
5. Automate – package steps 2‑4 in a Lambda (Python 3.12) triggered by EventBridge nightly; add SNS alert for any deletion.
AWS vs GCP comparison (quick reference):
| Feature | AWS IAM Access Analyzer | GCP IAM Recommender |
|---|---|---|
| Unused credential detection | UNUSED_IAM_CREDENTIAL findings | IAM policy “unused permissions” report |
| Automated revocation | CLI/SDK delete‑ calls | gcloud iam service-accounts keys delete |
| Scheduling | EventBridge + Lambda | Cloud Scheduler + Cloud Functions |
Gotcha: If a user is federated via an external IdP (SSO) the Access Analyzer finding shows the IAM user as unused, but the SSO session may still grant access through role assumption; always verify that no active SAML/OIDC sessions exist before deleting the user.