| Guid |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
A unique identifier that is a combination of the GUID of the selected Scan and the AWS IAM User’s unique ID. |
| FSName |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
A special unique identifier that is a combination of the UserName and the AWS Account ID. |
| Arn |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
Amazon Resource Name that uniquely identifies this IAM user across all of AWS. |
| AccountId |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The AWS account ID that this IAM user belongs to. |
| UserName |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The friendly name identifying the IAM user. |
| HasPassword |
BOOLEAN |
N/A (toggle) |
Indicates whether the user has a console login password set. |
| MfaEnabled |
BOOLEAN |
N/A (toggle) |
Indicates whether Multi-Factor Authentication (MFA) is enabled for this user. |
| HasConsoleAccess |
BOOLEAN |
N/A (toggle) |
Indicates whether the user has AWS Management Console access enabled. |
| IsPrivileged |
BOOLEAN |
N/A (toggle) |
Indicates whether the user has been identified as privileged based on their effective permissions. |
| IsInactive |
BOOLEAN |
N/A (toggle) |
Indicates whether the user has been inactive (no console or API activity) for longer than the defined inactivity threshold. |
| AWSTier |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
Privilege tier of the user based on their effective permissions. Higher values indicate greater privilege. |
| CreateDate |
DATE |
SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY |
The date and time when the IAM user was created. |
| PasswordLastUsed |
DATE |
SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY |
The date and time when the user’s password was last used to sign in to the AWS Management Console. |
| ExposurePoint |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
A numerical value indicating the level of exposure based on how many other entities can reach this user through attack paths. |
| risk |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The risk score of the user calculated based on vulnerability counts and severities. |
| IsShadow |
BOOLEAN |
N/A (toggle) |
Indicates that the user can compromise admin objects with at least one attack path without being an explicit admin. |
