Enumerate AWS IAM Users

Exposure of AWS IAM Usernames can further aid attackers efforts to access an AWS account. Exposure leaves users vulnerable to attacks such as phishing and password-spraying.

What is the risk of exposed AWS IAM Usernames?

• Exposing an AWS IAM username is not a direct threat but simplifies attackers' efforts to access an AWS account. With this information, they can initiate phishing campaigns or password-spraying attacks, potentially obtaining valid credentials and accessing the account

---

Methods to Enumerate AWS IAM Usernames

Using AWS Access Key ID

You must have valid access keys configured in the target account for this to work (aws configure)

aws --profile dev iam get-access-key-last-used --access-key-id AKIAxxxxxxxx

{
    "UserName": "admin",
    "AccessKeyLastUsed": {
        "LastUsedDate": "2024-12-08T03:42:00+00:00",
        "ServiceName": "ec2",
        "Region": "us-east-1"
    }
}

---

Unauthenticated IAM User Enumeration

• There are additional ways to enumerate IAM Users and Roles, see Enumerate (Unauthenticated) IAM Users and Roles