|
| 1 | +--- |
| 2 | +id: aws-iam-users |
| 3 | +title: AWS IAM Users |
| 4 | +sidebar_label: AWS IAM Users |
| 5 | +description: The AWS IAM Users app for Sumo Logic helps monitor user activity and security within your AWS environment. |
| 6 | +--- |
| 7 | + |
| 8 | +import useBaseUrl from '@docusaurus/useBaseUrl'; |
| 9 | + |
| 10 | +<img src={useBaseUrl('img/integrations/misc/aws-iam-logo.png')} alt="logo" width="80" /> |
| 11 | + |
| 12 | +The Sumo Logic app for AWS IAM Users provides clear insights into user activity and security within your AWS environment. Its intuitive dashboard helps you monitor and analyze user data to strengthen security and support compliance. With powerful visualizations, security teams can track user behavior, detect anomalies, and spot unauthorized access attempts. The app also helps monitor permissions, enforce best practices, and improve overall user management. Stay secure and informed with real-time monitoring and actionable insights from the AWS IAM Users app on Sumo Logic. |
| 13 | + |
| 14 | +## Log types |
| 15 | + |
| 16 | +This app uses Sumo Logic’s [AWS IAM Users Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/aws-iam-users-source/) to collect the users logs from the AWS IAM Users platform. |
| 17 | + |
| 18 | +### Sample log messages |
| 19 | + |
| 20 | +```json title="Users Log" |
| 21 | +{ |
| 22 | + "Arn": "arn:aws:iam::987883700038:user/alice", |
| 23 | + "CreateDate": "2024-03-20T07:57:17Z", |
| 24 | + "Path": "/", |
| 25 | + "UserId": "AIDA522VHNHFBP4UFAXLG", |
| 26 | + "UserName": "alice", |
| 27 | + "PasswordLastUsed": "2025-08-11T04:48:52Z", |
| 28 | + "PermissionsBoundary": null, |
| 29 | + "Tags": null |
| 30 | +} |
| 31 | +``` |
| 32 | + |
| 33 | +### Sample queries |
| 34 | + |
| 35 | +```sql title="Total Users" |
| 36 | +_sourceCategory="Labs/AWSIAMUsers" |
| 37 | +| json "UserId", "UserName", "CreateDate", "PasswordLastUsed", "PermissionsBoundary", "Arn" as user_id, user_name, create_date, password_last_used, permission_boundry, arn nodrop |
| 38 | + |
| 39 | +// global filters |
| 40 | +| where user_name matches "{{user_name}}" |
| 41 | + |
| 42 | +// panel specific |
| 43 | +| count by user_id |
| 44 | +| count |
| 45 | +``` |
| 46 | + |
| 47 | +```sql title="Never Logged Users" |
| 48 | +_sourceCategory="Labs/AWSIAMUsers" |
| 49 | +| json "UserId", "UserName", "CreateDate", "PasswordLastUsed", "PermissionsBoundary", "Arn" as user_id, user_name, create_date, password_last_used, permission_boundry, arn nodrop |
| 50 | + |
| 51 | +// global filters |
| 52 | +| where user_name matches "{{user_name}}" |
| 53 | + |
| 54 | +// panel specific |
| 55 | +| where isNull(password_last_used) |
| 56 | +| count by create_date, user_id, user_name |
| 57 | +| fields - _count |
| 58 | +| sort by create_date asc |
| 59 | +``` |
| 60 | + |
| 61 | +## Collection configuration and app installation |
| 62 | + |
| 63 | +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; |
| 64 | + |
| 65 | +<CollectionConfiguration/> |
| 66 | + |
| 67 | +:::important |
| 68 | +Use the [Cloud-to-Cloud Integration for AWS IAM Users](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/aws-iam-users-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your AWS IAM Users app is properly integrated and configured to collect and analyze your AWS IAM Users data. |
| 69 | +::: |
| 70 | + |
| 71 | +### Create a new collector and install the app |
| 72 | + |
| 73 | +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; |
| 74 | + |
| 75 | +<AppCollectionOPtion1/> |
| 76 | + |
| 77 | +### Use an existing collector and install the app |
| 78 | + |
| 79 | +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; |
| 80 | + |
| 81 | +<AppCollectionOPtion2/> |
| 82 | + |
| 83 | +### Use an existing source and install the app |
| 84 | + |
| 85 | +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; |
| 86 | + |
| 87 | +<AppCollectionOPtion3/> |
| 88 | + |
| 89 | +## Viewing the AWS IAM Users dashboards |
| 90 | + |
| 91 | +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; |
| 92 | + |
| 93 | +<ViewDashboards/> |
| 94 | + |
| 95 | +### Overview |
| 96 | + |
| 97 | +The **AWS IAM Users - Overview** dashboard provides a clear view of user activity, status, and security within AWS IAM. It highlights key metrics such as total users, login trends, newly created accounts, and the status of active, inactive, or never-logged-in users. This centralized dashboard helps security teams monitor user activity, detect potential risks, and ensure compliance with IAM best practices—improving both security and operational efficiency.<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/AWS-IAM-Users/AWS+IAM+Users+-+Overview.png' alt="AWS IAM Users - Overview" /> |
| 98 | + |
| 99 | +## Upgrading the AWS IAM Users app (Optional) |
| 100 | + |
| 101 | +import AppUpdate from '../../reuse/apps/app-update.md'; |
| 102 | + |
| 103 | +<AppUpdate/> |
| 104 | + |
| 105 | +## Uninstalling the AWS IAM Users app (Optional) |
| 106 | + |
| 107 | +import AppUninstall from '../../reuse/apps/app-uninstall.md'; |
| 108 | + |
| 109 | +<AppUninstall/> |
0 commit comments