1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
2. In the navigation pane, choose “Roles”. This will display a list of all the IAM roles that are currently configured within your AWS environment.
3. Click on the role that you want to check for inactivity. This will open the summary page for that role.
4. In the “Access Advisor” tab, you can see the services that the role can access and when those services were last accessed. If a service hasn’t been accessed in a long time, it might indicate role service inactivity.

1. Install and Configure AWS CLI: Before you can start using AWS CLI, you need to install it on your local machine. After installation, you need to configure it with your AWS account credentials. You can do this by running the command aws configure and then entering your AWS Access Key ID, Secret Access Key, Default region name, and Default output format when prompted.
2. List IAM Roles: The first step to detect Role Service Inactivity is to list all the IAM roles. You can do this by running the following command: aws iam list-roles. This command will return a list of all the IAM roles in your AWS account.
3. Get Role Last Used Details: For each role, you can get the details of when it was last used by running the following command: aws iam get-role --role-name <role-name>. Replace <role-name> with the name of the role. This command will return a JSON object that contains the details of the role, including when it was last used.
4. Check for Inactivity: Now, you can check if the role has been inactive. If the LastUsedDate field in the returned JSON object is more than 90 days ago, then the role is considered inactive. You can do this check manually, or you can write a script to automate this process. Here is a simple Python script that checks for role inactivity:

import boto3
from datetime import datetime, timedelta

# Create IAM client
iam = boto3.client('iam')

# List roles
roles = iam.list_roles()

# Check each role for inactivity
for role in roles['Roles']:
    # Get role last used details
    role_last_used = iam.get_role(RoleName=role['RoleName'])
    
    # Check if role has been used in the last 90 days
    if 'LastUsedDate' in role_last_used['Role']:
        last_used_date = role_last_used['Role']['LastUsedDate']
        if last_used_date < datetime.now() - timedelta(days=90):
            print(f"Role {role['RoleName']} is inactive.")

1. Install Boto3: Boto3 is the Amazon Web Services (AWS) Software Development Kit (SDK) for Python, which allows Python developers to write software that makes use of services like Amazon S3, Amazon EC2, etc. You can install it using pip:
   pip install boto3
   
2. Configure AWS Credentials: Before you can begin using Boto3, you should set up authentication credentials. You can do this by creating a new IAM user and assigning it the necessary permissions. Then, you can configure your AWS credentials either by setting environment variables or by creating a shared credentials file.
3. Python Script to List IAM Roles: You can use the following python script to list all IAM roles:
   import boto3
   
   # Create IAM client
   iam = boto3.client('iam')
   
   # List roles with the pagination interface
   paginator = iam.get_paginator('list_roles')
   for response in paginator.paginate():
       for role in response['Roles']:
           print(role)
   
4. Python Script to Check Role Service Inactivity: You can use the following python script to check role service inactivity. This script checks the last used timestamp of each role and prints out the roles that have not been used for a certain period of time (e.g., 90 days).
   import boto3
   from datetime import datetime, timedelta
   
   # Create IAM client
   iam = boto3.client('iam')
   
   # Define the inactivity period
   inactivity_period = timedelta(days=90)
   
   # List roles with the pagination interface
   paginator = iam.get_paginator('list_roles')
   for response in paginator.paginate():
       for role in response['Roles']:
           # Get role last used details
           role_last_used = iam.get_role_last_used(RoleName=role['RoleName'])
           # Check if the role has been used
           if 'LastUsedDate' in role_last_used['RoleLastUsed']:
               last_used_date = role_last_used['RoleLastUsed']['LastUsedDate']
               # Check if the role has been inactive for the defined period
               if (datetime.now(last_used_date.tzinfo) - last_used_date) > inactivity_period:
                   print(f"The role {role['RoleName']} has been inactive for more than {inactivity_period.days} days.")
           else:
               print(f"The role {role['RoleName']} has never been used.")
   

1. Log in to the AWS Management Console and navigate to the IAM dashboard.
2. Click on “Roles” in the left-hand menu.
3. Sort the roles by “Last activity” by clicking on the “Last activity” column header.
4. Identify the inactive roles that have not been used for a prolonged period of time.
5. Click on the inactive role that you want to remediate.
6. Click on the “Permissions” tab.
7. Review the permissions assigned to the role and ensure that they are up-to-date and necessary.
8. If the role is no longer needed, click on the “Delete role” button to remove it.
9. If the role is still needed, but the permissions need to be updated, click on the “Edit policy” button to modify the role’s permissions.
10. Once you have made the necessary changes, click on the “Save changes” button to apply them.

​

1. Identify the inactive roles: Run the following command to list all the IAM roles and their last activity date.

aws iam list-roles --query 'Roles[*].[RoleName,CreateDate,RoleId,AssumeRolePolicyDocument,MaxSessionDuration,LastUsed]'

2. Review the output and identify any roles that have not been used for a prolonged period of time.
3. Remove unused roles: If a role has not been used for a prolonged period of time and is no longer required, it should be removed. To delete a role, run the following command:

aws iam delete-role --role-name <RoleName>

4. Rotate access keys: If the inactive role has access keys associated with it, it is recommended to rotate them. To rotate the access keys, follow these steps:

• Create a new access key for the user associated with the role.

aws iam create-access-key --user-name <UserName>

• Update the access key in any scripts or applications that use it.
• Delete the old access key.

aws iam delete-access-key --access-key-id <AccessKeyId> --user-name <UserName>

5. Monitor the roles: To prevent the “Role Service Inactivity” misconfiguration from occurring again, it is recommended to regularly monitor the IAM roles and their activity. You can use AWS CloudTrail to track the usage of IAM roles and set up alerts to notify you when a role has been inactive for a prolonged period of time.

1. Install the AWS SDK for Python (Boto3) using pip:
   pip install boto3
   
2. Create a Boto3 client for IAM:
   import boto3
   
   iam = boto3.client('iam')
   
3. Get a list of all IAM roles:
   response = iam.list_roles()
   
   roles = response['Roles']
   
4. Loop through the list of roles and check the last time each role was used:
   from datetime import datetime, timezone
   
   for role in roles:
       response = iam.get_role_last_used(RoleName=role['RoleName'])
       last_used = response.get('RoleLastUsed').get('LastUsedDate')
   
       if last_used is not None:
           now = datetime.now(timezone.utc)
           days_since_last_used = (now - last_used).days
   
           if days_since_last_used > 90:
               # Do something to remediate the misconfiguration
               print(f"Role {role['RoleName']} has not been used in {days_since_last_used} days.")
   
5. In the above code, we are checking if a role has not been used in the last 90 days. If a role has not been used in 90 days, you can take any remediation action that is appropriate. For example, you could delete the role, disable the role, or rotate the credentials associated with the role. Note: Before taking any action, make sure you understand the impact of the action and have appropriate permissions to take the action.
   iam.delete_role(RoleName=role['RoleName'])
   
   or
   iam.update_role(RoleName=role['RoleName'], MaxSessionDuration=3600)
   
   or any other appropriate action based on your organization’s policies and procedures.