How to know if an AWS IAM role is actually being used
There currently is no method using SDKs for the AWS CLI to get the last accessed time of an IAM role. I confirmed this today with AWS support.
Currently, the only way is to use the AWS Management Console.
- Select your IAM role
- Click the "Access Advisor" tab.
- The contents of this tab will display the last access time for each of the various services (S3, EC2, etc.)