Help Center/ Identity and Access Management_Identity and Access Management (New Edition)/ User Guide/ Identity/ IAM Users/ Checking Unused IAM Credentials
Updated on 2025-11-07 GMT+08:00
View PDF
Share

Checking Unused IAM Credentials

For higher security of your account, delete unnecessary IAM user credentials (passwords and access keys). For example, if a user leaves your organization or no longer needs to access Huawei Cloud, invalidate the credentials used by the user. You should delete such credentials and create new credentials anytime you need them. If you do not want to delete the credentials, change passwords or disable access keys to invalidate the credentials.

"Unused credentials" refer to those that have not been used within a specified period.

Checking Unused Passwords

  • You can check the last login time of each user on the IAM console to see if their passwords are in use.
    1. Log in to the new IAM console as an administrator.
    2. In the navigation pane, choose Users.
    3. If there is no Last Login column in the user list, perform the following steps:
      1. In the upper right corner of the user list, click the settings icon.
      2. In the Custom Columns list, select Last Login.

      3. Click OK.
    4. The Last Login column displays the time when a user last logged in to the Huawei Cloud console. You can locate the users who have not used their passwords for a certain period of time. For users who have never logged in using a password, this column displays --.
  • You can also check the last login time in the user details on the IAM console to find unused passwords.
    1. Log in to the new IAM console as an administrator.
    2. In the navigation pane, choose Users.
    3. Click a username to go to the user details page. In the Basic Information area, check the Last Login field.

Checking Unused Access Keys

You can check the last used time of each access key in the security settings of a user to find unused access keys.
  1. Log in to the new IAM console as an administrator.
  2. In the navigation pane, choose Users.
  3. In the user list, click Security Settings in the Operation column of a desired user. On the displayed page, check the Last Used column of each access key.

  4. The Last Used column displays the latest time when the access key was used for API calls or when the access key status changes. You can use this information to find access keys that have not been used in a specified period and then handle these unused access keys. If an access key has never been used, the Last Used column displays --.

You can also use the IAM access analyzer to find unused passwords and access keys. For details, see Creating an Unused Access Analyzer, Reviewing Unused Access Findings, Resolving Unused Access Findings, and Archiving Findings.

Parent topic: IAM Users