AWS CLI Usage Issue

In our scenario, We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or if they were perhaps not using these credentials?

The ATHENA Queries I was tried

SELECT eventTime, eventName, userIdentity.principalId,eventSource
FROM athena-table
WHERE useridentity.accesskeyid like 'AKIAIOSFODNN7EXAMPLE'

SELECT *
FROM athena-table
WHERE useridentity.type = 'IAMUser'
AND useridentity.username LIKE 'Alice';

In the IAM Console Last activity is shown as Never.

We'll be deleting that user but prior to doing that I wanted to see how she was using the account without logging. Is there a better way to find out this?

The Credential Report should be the right way to investigate this on the cloud end.

You can get the user to check what they have in ~/.aws/config and ~/.aws/credentials to confirm which credentials they're using.

It looks like this:

[profile_name]
aws_access_key_id = SHORTERSTRING
aws_secret_access_key = LONGERSTRINGGOESHEREWITHMORECHARS

Use the credential report to find out when the IAM user last used an access key. If it looks wrong, then you may need to dig in to CloudTrail logs to find out when/where the key is being used.

More gung-ho approach would be to go through revoking the access keys until someone yells at you :D