How to Backup IAM User in AWS - amazon-web-services

Question

I want to delete several IAM Users in AWS Account, is there a way to backup them first so if something bad happen i can restore again?

Answer 1

If you have AWS Config snapshots enabled then the IAM user details will be captured as per example below.
Another option you can use is the IAM access advisor to determine last activity and what permissions the user has been performing. If nothing over a period of weeks/months then perhaps it is safe to delete.
https://aws.amazon.com/about-aws/whats-new/2019/06/now-use-iam-access-advisor-with-aws-organizations-to-set-permission-guardrails-confidently/
Also as mentioned earlier, you can also just disable any keys associated with that user and remove all inline/attached policies. Keep for a while and see what breaks.
{
"relatedEvents": [],
"relationships": [
{
"resourceId": "<########>",
"resourceName": "admins",
"resourceType": "AWS::IAM::Group",
"name": "Is attached to Group"
}
],
"configuration": {
"path": "/",
"userName": "<########>",
"userId": "<########>",
"arn": "arn:aws:iam::<########>:user/<########>",
"createDate": "2018-04-12T00:11:34.000Z",
"userPolicyList": [],
"groupList": [
"admins"
],
"attachedManagedPolicies": []
},
"supplementaryConfiguration": {},
"tags": {},
"configurationItemVersion": "1.3",
"configurationItemCaptureTime": "2018-04-12T00:26:56.332Z",
"configurationStateId": <########>,
"awsAccountId": "<########>",
"configurationItemStatus": "ResourceDiscovered",
"resourceType": "AWS::IAM::User",
"resourceId": "<########>",
"resourceName": "<########>",
"ARN": "arn:aws:iam::<########>:user/<########>",
"awsRegion": "global",
"availabilityZone": "Not Applicable",
"configurationStateMd5Hash": "",
"resourceCreationTime": "2018-04-12T00:11:34.000Z"
}
https://docs.aws.amazon.com/config/latest/developerguide/resource-config-reference.html