Is there any way I can get a list of removed or deleted user in AWS ? All I am getting is list of users who all are active but I need a list of removed user. I have tried to get logs out of cloud trail but could not find the relevant event. I not much familiar with AWS maybe because of this I could not find any module for this. Thank you

CodePudding user response：

I can get a list of removed or deleted user in AWS ?

No. Once deleted its deleted and information cannot be retrieved. even I couldn't find any information about the deleted user

Once way could be which is very trivial.

• You can generate a credential report when you have all the users.( note if you generate the report again it will be overwritten with the current status of users
• and then compare it with a list of users who are there.

CodePudding user response：

You can able to find out the delete user with the following eventName in the AWS Cloudtrail.

"eventName:DeleteUser"

However by default, the AWS Cloudtrail has only past 90 days activities only.