Find out which IAM user created a given resource

Question

I have multiple IAM users under my account. Is there a way to know which IAM user created a particular resource, such as an EC2 instance or an Elastic Search Cluster?

Here is a simple script which I use to list owner of EC2 Instances https://gist.github.com/sudharsans/39d5eaf8a82b7ccdf8b3230d13ba7d81 — Sudharsan Sivasankaran, Feb 20 '18 at 15:33

score 2 · Accepted Answer · answered Feb 20 '18 at 14:16

2

You can find this using cloudtrail. You can search for the relevant api actions on the console (for last 90 days) and search in the logs saved on S3 for api actions older than 90 days. Details here

answered Feb 20 '18 at 14:16

abiydv

571
2
8

score 0 · Answer 2 · answered Sep 26 '22 at 06:59

0

There are 3-way Cloud trail, Cloud watch and Athena. follow the link below

https://aws.amazon.com/premiumsupport/knowledge-center/view-iam-history/

answered Sep 26 '22 at 06:59

Amit Kumar

1

Find out which IAM user created a given resource

2 Answers2

Linked