Improvado
Esc

Start typing to search.

Improvado
Sign In

AWS IAM

Written by Ilya Sudakov

Updated on Sep 18, 2026

Description

AWS Identity and Access Management is the service that holds the users, groups, roles and policies of an AWS account — who can sign in, and what they are allowed to do once they have.

Connecting AWS IAM to Improvado brings two of those things into your warehouse: the list of IAM users in the account, and the metadata of their access keys — key ID, status and creation date. Held next to the rest of your business data, that is what makes questions like which keys have gone stale, or how account membership has drifted over a quarter, answerable from a report rather than from a console session.

Setup guide

Follow our setup guide to connect AWS IAM to Improvado.

Click the Connections in the left navigation bar.
Categories on the Data sources page group all available platforms. Use a search to find the required one.

Click on the AWS IAM tile.

Authorize your AWS account using the fields below:

  • Access Key ID — required. The access key ID of the IAM user, for example AKIAIOSFODNN7EXAMPLE.
  • Secret Access Key — required. The secret shown when that access key was created.
  • AWS Region — optional, defaults to us-east-1. IAM itself is global; the region only affects how the request is signed.
  • Session Token — optional. Fill this in only when you are using temporary credentials issued by AWS STS.
  • Environment — optional. A label of your choice to tell one AWS environment from another, for example production.

Open the AWS IAM console and choose Users in the navigation pane. Use an existing IAM user or create one for Improvado.

Give that user read access. The ReadOnlyAccess managed policy is enough; if you prefer a minimal policy, grant iam:GetUser, iam:ListUsers and iam:ListAccessKeys.

Open the user, go to the Security credentials tab, and in the Access keys section click Create access key.

On the Access key best practices & alternatives page, choose Other and click Next. A description tag on the next page is optional.

Click Show to reveal the secret access key, or Download .csv file, and enter both values into the Improvado authorization form.

Warning
AWS shows the secret access key once. If you leave the page without copying it, the key cannot be recovered — you have to delete it and create another. An IAM user can hold at most two access keys, so if Create access key is greyed out, delete an unused key first.
Note
Improvado only reads. iam:GetUser is called once to verify the credentials when you connect; iam:ListUsers and iam:ListAccessKeys are what the two report types use. Nothing in your AWS account is created, changed or deleted through this connection, and no secret access key of yours is ever read — the Access Keys report returns key IDs, status and dates only.

AWS describes the same flow in How an IAM administrator can manage IAM user access keys.

After completing the connection process, the AWS IAM connection will appear in your Connected sources list.

When the connection status is Active, and the account status column shows a number of accounts, you can move on to data extraction.

To extract data from the connected sources, check the instructions on how to set up data extraction.

Schema information

The schema information shows all report types you can use to extract data from AWS IAM.

Release notes

You can find information about the latest changes in the AWS IAM document history.

Troubleshooting

Having trouble with your setup? Find solutions to common issues →

Was this article helpful?