> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/aws-entities/aws-iam-user.md).

# AWS IAM User

### AWS IAM User Fields

| Field            | Type    | Possible Operators                                             | Description                                                                                                                   |
| ---------------- | ------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| Guid             | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A unique identifier that is a combination of the GUID of the selected Scan and the AWS IAM User's unique ID.                  |
| FSName           | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A special unique identifier that is a combination of the UserName and the AWS Account ID.                                     |
| Arn              | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Amazon Resource Name that uniquely identifies this IAM user across all of AWS.                                                |
| AccountId        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The AWS account ID that this IAM user belongs to.                                                                             |
| UserName         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The friendly name identifying the IAM user.                                                                                   |
| HasPassword      | BOOLEAN | N/A (toggle)                                                   | Indicates whether the user has a console login password set.                                                                  |
| MfaEnabled       | BOOLEAN | N/A (toggle)                                                   | Indicates whether Multi-Factor Authentication (MFA) is enabled for this user.                                                 |
| HasConsoleAccess | BOOLEAN | N/A (toggle)                                                   | Indicates whether the user has AWS Management Console access enabled.                                                         |
| IsPrivileged     | BOOLEAN | N/A (toggle)                                                   | Indicates whether the user has been identified as privileged based on their effective permissions.                            |
| IsInactive       | BOOLEAN | N/A (toggle)                                                   | Indicates whether the user has been inactive (no console or API activity) for longer than the defined inactivity threshold.   |
| AWSTier          | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Privilege tier of the user based on their effective permissions. Higher values indicate greater privilege.                    |
| CreateDate       | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | The date and time when the IAM user was created.                                                                              |
| PasswordLastUsed | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | The date and time when the user's password was last used to sign in to the AWS Management Console.                            |
| ExposurePoint    | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | A numerical value indicating the level of exposure based on how many other entities can reach this user through attack paths. |
| risk             | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The risk score of the user calculated based on vulnerability counts and severities.                                           |
| IsShadow         | BOOLEAN | N/A (toggle)                                                   | Indicates that the user can compromise admin objects with at least one attack path without being an explicit admin.           |