IAM activity dashboard

Monitor your Amazon Web Services (AWS) user activity to uncover suspicious behaviors that might be associated with malicious activity, such as activity spikes or unusual events.

Use the IAM activity dashboard to monitor user activity in your environment, including the error events, which users have the most activity, activity over time, and the detailed list of error activities.

1. From the menu bar, select Analytics and then Cloud security.
2. Select IAM activity.

The IAM activity dashboard includes the following panels:

Panel	Source type	Datamodel
Error events	aws:cloudtrail	datamodel=Change.All_Changes nodename=All_Changes.Account_Management
Activity by user	aws:cloudtrail	datamodel=Change.All_Changes nodename=All_Changes.Account_Management
IAM actions	aws:cloudtrail	datamodel=Change.All_Changes nodename=All_Changes.Account_Management
IAM actions over time	aws:cloudtrail	datamodel=Change.All_Changes nodename=All_Changes.Account_Management
Success vs failure activity	aws:cloudtrail	datamodel=Change.All_Changes nodename=All_Changes.Account_Management
Most recent IAM activity	aws:cloudtrail	datamodel:"Change.Account_Management"
IAM error activity	aws:cloudtrail	datamodel:"Change.Account_Management"

Filter your panel results

You can filter the results that you see in the dashboard panels.

Filter	Description
Account ID	Specify one or more of the data account IDs that you chose during onboarding.
Regions	Specify one or more of the data source regions that you chose during onboarding.
Status	Choose from the following statuses: All - All event statuses, including both successes and errors. Error - Only error event statuses. Some panels are based on error trends, so there is no difference in the results if you select All or if you select Error.
Action	Choose from the following actions: All - All event actions. Each action - You can filter on each action individually or a combination of actions.
Time range	Define the time range of a search with the time range picker.