AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.
Retrieves a service last accessed report that was created using the
Service last accessed data does not use other policy types when determining whether
a resource could access a service. These other policy types include resource-based
policies, access control lists, Organizations policies, IAM permissions boundaries,
and STS assume role policies. It only applies permissions policy logic. For more about
the evaluation of policy types, see Evaluating
policies in the IAM User Guide.
GenerateServiceLastAccessedDetails
operation. You can use the JobId parameter in GetServiceLastAccessedDetails
to retrieve the status of your report job. When the report is complete, you can retrieve
the generated report. The report includes a list of Amazon Web Services services that
the resource (user, group, role, or managed policy) can access.
For each service that the resource could access using permissions policies, the operation
returns details about the most recent access attempt. If there was no attempt, the
service is listed without details about the most recent attempt to access the service.
If the operation fails, the GetServiceLastAccessedDetails operation returns
the reason that it failed.
The GetServiceLastAccessedDetails operation returns a list of services. This
list includes the number of entities that have attempted to access the service and
the date and time of the last attempt. It also returns the ARN of the following entity,
depending on the resource ARN that you used to generate the report:
User – Returns the user ARN that you used to generate the report
Group – Returns the ARN of the group member (user) that last attempted to access the service
Role – Returns the role ARN that you used to generate the report
Policy – Returns the ARN of the user or role that last used the policy to attempt to access the service
By default, the list is sorted by service namespace.
If you specified ACTION_LEVEL granularity when you generated the report, this
operation returns service and action last accessed data. This includes the most recent
access attempt for each tracked action within a service. Otherwise, this operation
returns only service data.
For more information about service and action last accessed data, see Reducing permissions using service last accessed data in the IAM User Guide.
This is an asynchronous operation using the standard naming convention for .NET 4.5 or higher. For .NET 3.5 the operation is implemented as a pair of methods using the standard naming convention of BeginGetServiceLastAccessedDetails and EndGetServiceLastAccessedDetails.
Namespace: Amazon.IdentityManagement
Assembly: AWSSDK.IdentityManagement.dll
Version: 3.x.y.z
public virtual Task<GetServiceLastAccessedDetailsResponse> GetServiceLastAccessedDetailsAsync( GetServiceLastAccessedDetailsRequest request, CancellationToken cancellationToken )
Container for the necessary parameters to execute the GetServiceLastAccessedDetails service method.
A cancellation token that can be used by other objects or threads to receive notice of cancellation.
| Exception | Condition |
|---|---|
| InvalidInputException | The request was rejected because an invalid or out-of-range value was supplied for an input parameter. |
| NoSuchEntityException | The request was rejected because it referenced a resource entity that does not exist. The error message describes the resource. |
.NET Core App:
Supported in: 3.1
.NET Standard:
Supported in: 2.0
.NET Framework:
Supported in: 4.5