Glossary
IAM credential report
A CSV listing every IAM user and the root user with password, MFA and access-key status and last-used dates — a snapshot of who can sign in to an AWS account.
The IAM credential report is a CSV generated on demand (at most once every
four hours) that lists every IAM user and the root user with their
credential status: password_enabled, password_last_used, mfa_active,
access_key_1_active, access_key_1_last_used_date and the same for the
second key, plus signing certificates.
In an investigation it answers posture questions — does root have access
keys, which console users lack MFA — and dates users and keys created
during the incident (user_creation_time, access_key_1_last_rotated).
Last-used fields record only the first use in each 15-minute span, so
CloudTrail remains the source for activity.
See how to export it. Reference: IAM credential reports.