Repository: cloud-custodian/cloud-custodian

Issue:
aws - usage filter for iam roles/users

use new iam service support around access advisor via api to allow policy authors to filter on actual usage of a given role/user. 

as a followup once this lands we should probably deprecate or at least warn on `iam-role`'s unused filter since it is pretty limit (ecs, lambda, ec2) and the consumers of a role are many and varied, which would address #3450


Discussion:

Resolving patch:
diff --git a/c7n/actions/securityhub.py b/c7n/actions/securityhub.py
--- a/c7n/actions/securityhub.py
+++ b/c7n/actions/securityhub.py
@@ -190,7 +190,9 @@ def process(self, resources, event=None):
                 "securityhub", region_name=region_name)
 
         now = datetime.utcnow().replace(tzinfo=tzutc()).isoformat()
-        batch_size = self.data.get('batch_size', 10)
+        # default batch size to one to work around security hub console issue
+        # which only shows a single resource in a finding.
+        batch_size = self.data.get('batch_size', 1)
         stats = Counter()
         for key, grouped_resources in self.group_resources(resources).items():
             for resource_set in chunks(grouped_resources, batch_size):
diff --git a/c7n/resources/iam.py b/c7n/resources/iam.py
--- a/c7n/resources/iam.py
+++ b/c7n/resources/iam.py
@@ -35,6 +35,7 @@
 from c7n.actions.securityhub import OtherResourcePostFinding
 from c7n.exceptions import PolicyValidationError
 from c7n.filters import ValueFilter, Filter, OPERATORS
+from c7n.filters.multiattr import MultiAttrFilter
 from c7n.filters.iamaccess import CrossAccountAccessFilter
 from c7n.manager import resources
 from c7n.query import QueryResourceManager, DescribeSource
@@ -139,6 +140,25 @@ class resource_type(object):
         global_resource = True
         arn = 'Arn'
 
+    def get_source(self, source_type):
+        if source_type == 'describe':
+            return DescribeUser(self)
+        return super(User, self).get_source(source_type)
+
+
+class DescribeUser(DescribeSource):
+
+    def get_resources(self, resource_ids, cache=True):
+        client = local_session(self.manager.session_factory).client('iam')
+        results = []
+
+        for r in resource_ids:
+            try:
+                results.append(client.get_user(UserName=r)['User'])
+            except client.exceptions.NoSuchEntityException:
+                continue
+        return results
+
 
 @User.action_registry.register('tag')
 class UserTag(Tag):
@@ -264,6 +284,124 @@ class resource_type(object):
         global_resource = True
 
 
+@User.filter_registry.register('usage')
+@Role.filter_registry.register('usage')
+@Group.filter_registry.register('usage')
+@Policy.filter_registry.register('usage')
+class ServiceUsage(Filter):
+    """Filter iam resources by their api/service usage.
+
+    Note recent activity (last 4hrs) may not be shown, evaluation
+    is against the last 365 days of data.
+
+    Each service access record is evaluated against all specified
+    attributes.  Attribute filters can be specified in short form k:v
+    pairs or in long form as a value type filter.
+
+    match-operator allows to specify how a resource is treated across
+    service access record matches. 'any' means a single matching
+    service record will return the policy resource as matching. 'all'
+    means all service access records have to match.
+
+
+    Find iam users that have not used any services in the last year
+
+    :example:
+
+    .. code-block:: yaml
+
+      - name: unused-users
+        resource: iam-user
+        filters:
+          - type: usage
+            match-operator: all
+            LastAuthenticated: null
+
+    Find iam users that have used dynamodb in last 30 days
+
+    :example:
+
+    .. code-block:: yaml
+
+      - name: unused-users
+        resource: iam-user
+        filters:
+          - type: usage
+            ServiceNamespace: dynamodb
+            TotalAuthenticatedEntities: 1
+            LastAuthenticated:
+              type: value
+              value_type: age
+              op: less-than
+              value: 30
+            match-operator: any
+
+    https://aws.amazon.com/blogs/security/automate-analyzing-permissions-using-iam-access-advisor/
+
+    """
+
+    JOB_COMPLETE = 'COMPLETED'
+    SERVICE_ATTR = set((
+        'ServiceName', 'ServiceNamespace', 'TotalAuthenticatedEntities',
+        'LastAuthenticated', 'LastAuthenticatedEntity'))
+
+    schema_attr = {
+        sa: {'oneOf': [
+            {'type': 'string'},
+            {'type': 'boolean'},
+            {'type': 'number'},
+            {'type': 'null'},
+            {'$ref': '#/definitions/filters/value'}]}
+        for sa in SERVICE_ATTR}
+    schema_attr['match-operator'] = {'enum': ['all', 'any']}
+    schema_attr['poll-delay'] = {'type': 'number'}
+    schema = type_schema(
+        'usage',
+        required=('match-operator',),
+        **schema_attr)
+    permissions = ('iam:GenerateServiceLastAccessedDetails',
+                   'iam:GetServiceLastAccessedDetails')
+
+    def process(self, resources, event=None):
+        client = local_session(self.manager.session_factory).client('iam')
+
+        job_resource_map = {}
+        for arn, r in zip(self.manager.get_arns(resources), resources):
+            jid = self.manager.retry(
+                client.generate_service_last_accessed_details,
+                Arn=arn)['JobId']
+            job_resource_map[jid] = r
+
+        conf = dict(self.data)
+        conf.pop('match-operator')
+        saf = MultiAttrFilter(conf)
+        saf.multi_attrs = self.SERVICE_ATTR
+
+        results = []
+        match_operator = self.data.get('match-operator', 'all')
+
+        while job_resource_map:
+            job_results_map = {}
+            for jid, r in job_resource_map.items():
+                result = self.manager.retry(
+                    client.get_service_last_accessed_details, JobId=jid)
+                if result['JobStatus'] != self.JOB_COMPLETE:
+                    continue
+                job_results_map[jid] = result['ServicesLastAccessed']
+
+            for jid, saf_results in job_results_map.items():
+                r = job_resource_map.pop(jid)
+                saf_matches = saf.process(saf_results)
+                if match_operator == 'all' and len(saf_matches) == len(saf_results):
+                    results.append(r)
+                elif saf_matches:
+                    results.append(r)
+
+            time.sleep(self.data.get('poll-delay', 2))
+
+        return results
+
+
 @User.filter_registry.register('check-permissions')
 @Group.filter_registry.register('check-permissions')
 @Role.filter_registry.register('check-permissions')


Test patch:
diff --git a/tests/data/placebo/test_iam_user_usage/iam.GenerateServiceLastAccessedDetails_1.json b/tests/data/placebo/test_iam_user_usage/iam.GenerateServiceLastAccessedDetails_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_user_usage/iam.GenerateServiceLastAccessedDetails_1.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200,
+    "data": {
+        "JobId": "74b4bb8f-ef21-ed9c-7273-1114908d4198",
+        "ResponseMetadata": {
+            "RequestId": "605713ef-458f-11e9-a1c2-c103d986345a",
+            "HTTPStatusCode": 200,
+            "HTTPHeaders": {
+                "x-amzn-requestid": "605713ef-458f-11e9-a1c2-c103d986345a",
+                "content-type": "text/xml",
+                "content-length": "395",
+                "date": "Wed, 13 Mar 2019 12:56:10 GMT"
+            },
+            "RetryAttempts": 0
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_user_usage/iam.GetServiceLastAccessedDetails_1.json b/tests/data/placebo/test_iam_user_usage/iam.GetServiceLastAccessedDetails_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_user_usage/iam.GetServiceLastAccessedDetails_1.json
@@ -0,0 +1,28 @@
+{
+    "status_code": 200,
+    "data": {
+        "JobStatus": "IN_PROGRESS",
+        "JobCreationDate": {
+            "__class__": "datetime",
+            "year": 2019,
+            "month": 3,
+            "day": 13,
+            "hour": 12,
+            "minute": 56,
+            "second": 11,
+            "microsecond": 74000
+        },
+        "IsTruncated": false,
+        "ResponseMetadata": {
+            "RequestId": "605fc6a4-458f-11e9-a1c2-c103d986345a",
+            "HTTPStatusCode": 200,
+            "HTTPHeaders": {
+                "x-amzn-requestid": "605fc6a4-458f-11e9-a1c2-c103d986345a",
+                "content-type": "text/xml",
+                "content-length": "459",
+                "date": "Wed, 13 Mar 2019 12:56:10 GMT"
+            },
+            "RetryAttempts": 0
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_user_usage/iam.GetServiceLastAccessedDetails_2.json b/tests/data/placebo/test_iam_user_usage/iam.GetServiceLastAccessedDetails_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_user_usage/iam.GetServiceLastAccessedDetails_2.json
@@ -0,0 +1,1959 @@
+{
+    "status_code": 200,
+    "data": {
+        "JobStatus": "COMPLETED",
+        "JobCreationDate": {
+            "__class__": "datetime",
+            "year": 2019,
+            "month": 3,
+            "day": 13,
+            "hour": 12,
+            "minute": 56,
+            "second": 11,
+            "microsecond": 74000
+        },
+        "ServicesLastAccessed": [
+            {
+                "ServiceName": "Alexa for Business",
+                "ServiceNamespace": "a4b",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Certificate Manager",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 8,
+                    "hour": 14,
+                    "minute": 55,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "acm",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Certificate Manager Private Certificate Authority",
+                "ServiceNamespace": "acm-pca",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Amplify",
+                "ServiceNamespace": "amplify",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Manage - Amazon API Gateway",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 12,
+                    "day": 19,
+                    "hour": 3,
+                    "minute": 14,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "apigateway",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Application Auto Scaling",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "application-autoscaling",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon AppStream 2.0",
+                "ServiceNamespace": "appstream",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS AppSync",
+                "ServiceNamespace": "appsync",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Artifact",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2016,
+                    "month": 12,
+                    "day": 3,
+                    "hour": 18,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "artifact",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Athena",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 1,
+                    "day": 12,
+                    "hour": 16,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "athena",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon EC2 Auto Scaling",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 2,
+                    "hour": 20,
+                    "minute": 11,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "autoscaling",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Auto Scaling",
+                "ServiceNamespace": "autoscaling-plans",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Marketplace",
+                "ServiceNamespace": "aws-marketplace",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Marketplace Management Portal",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 5,
+                    "day": 3,
+                    "hour": 15,
+                    "minute": 35,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "aws-marketplace-management",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Billing",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 8,
+                    "day": 23,
+                    "hour": 15,
+                    "minute": 16,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "aws-portal",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Backup",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 1,
+                    "day": 17,
+                    "hour": 15,
+                    "minute": 40,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "backup",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Batch",
+                "ServiceNamespace": "batch",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Budget Service",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 3,
+                    "day": 4,
+                    "hour": 17,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "budgets",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Cost Explorer Service",
+                "ServiceNamespace": "ce",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Chime",
+                "ServiceNamespace": "chime",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Cloud9",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 12,
+                    "day": 28,
+                    "hour": 8,
+                    "minute": 34,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "cloud9",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Cloud Directory",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 8,
+                    "hour": 15,
+                    "minute": 57,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "clouddirectory",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS CloudFormation",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 28,
+                    "hour": 14,
+                    "minute": 3,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "cloudformation",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon CloudFront",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 11,
+                    "day": 24,
+                    "hour": 19,
+                    "minute": 34,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "cloudfront",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS CloudHSM",
+                "ServiceNamespace": "cloudhsm",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon CloudSearch",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2016,
+                    "month": 11,
+                    "day": 27,
+                    "hour": 13,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "cloudsearch",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS CloudTrail",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "cloudtrail",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon CloudWatch",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 2,
+                    "hour": 20,
+                    "minute": 11,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "cloudwatch",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS CodeBuild",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 19,
+                    "hour": 18,
+                    "minute": 15,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "codebuild",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS CodeCommit",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 19,
+                    "hour": 17,
+                    "minute": 32,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "codecommit",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS CodeDeploy",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "codedeploy",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS CodePipeline",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 4,
+                    "day": 28,
+                    "hour": 19,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "codepipeline",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS CodeStar",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 5,
+                    "day": 26,
+                    "hour": 7,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "codestar",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Cognito Identity",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 8,
+                    "day": 12,
+                    "hour": 11,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "cognito-identity",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Cognito User Pools",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 4,
+                    "day": 26,
+                    "hour": 13,
+                    "minute": 1,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "cognito-idp",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Cognito Sync",
+                "ServiceNamespace": "cognito-sync",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Comprehend",
+                "ServiceNamespace": "comprehend",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Comprehend Medical",
+                "ServiceNamespace": "comprehendmedical",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Config",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 26,
+                    "hour": 21,
+                    "minute": 40,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "config",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Connect",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 5,
+                    "day": 4,
+                    "hour": 9,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "connect",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Cost and Usage Report",
+                "ServiceNamespace": "cur",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Data Pipeline",
+                "ServiceNamespace": "datapipeline",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "DataSync",
+                "ServiceNamespace": "datasync",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon DynamoDB Accelerator (DAX)",
+                "ServiceNamespace": "dax",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS DeepLens",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 12,
+                    "day": 1,
+                    "hour": 15,
+                    "minute": 28,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "deeplens",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Device Farm",
+                "ServiceNamespace": "devicefarm",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Direct Connect",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 2,
+                    "day": 17,
+                    "hour": 8,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "directconnect",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Application Discovery Service",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 10,
+                    "day": 28,
+                    "hour": 15,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "discovery",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Data Lifecycle Manager",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 8,
+                    "day": 25,
+                    "hour": 10,
+                    "minute": 18,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "dlm",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Database Migration Service",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 1,
+                    "day": 14,
+                    "hour": 10,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "dms",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Directory Service",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 28,
+                    "hour": 14,
+                    "minute": 7,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "ds",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon DynamoDB",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 8,
+                    "hour": 18,
+                    "minute": 3,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "dynamodb",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon EC2",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 9,
+                    "hour": 18,
+                    "minute": 25,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "ec2",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Message Delivery Service",
+                "ServiceNamespace": "ec2messages",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Elastic Container Registry",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 19,
+                    "hour": 17,
+                    "minute": 32,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "ecr",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Elastic Container Service",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 28,
+                    "hour": 14,
+                    "minute": 3,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "ecs",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Elastic Container Service for Kubernetes",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 16,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "eks",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Elastic Inference",
+                "ServiceNamespace": "elastic-inference",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon ElastiCache",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 7,
+                    "day": 6,
+                    "hour": 9,
+                    "minute": 44,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "elasticache",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Elastic Beanstalk",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 11,
+                    "day": 24,
+                    "hour": 19,
+                    "minute": 34,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "elasticbeanstalk",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Elastic File System",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 1,
+                    "day": 23,
+                    "hour": 19,
+                    "minute": 43,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "elasticfilesystem",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Elastic Load Balancing",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 2,
+                    "hour": 20,
+                    "minute": 11,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "elasticloadbalancing",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Elastic MapReduce",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 2,
+                    "day": 17,
+                    "hour": 8,
+                    "minute": 34,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "elasticmapreduce",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Elastic Transcoder",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 10,
+                    "day": 8,
+                    "hour": 18,
+                    "minute": 14,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "elastictranscoder",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Elasticsearch Service",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 3,
+                    "day": 30,
+                    "hour": 9,
+                    "minute": 10,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "es",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon CloudWatch Events",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 7,
+                    "hour": 16,
+                    "minute": 44,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "events",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon API Gateway",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 3,
+                    "day": 30,
+                    "hour": 21,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "execute-api",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Kinesis Firehose",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "firehose",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Firewall Manager",
+                "ServiceNamespace": "fms",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon FreeRTOS",
+                "ServiceNamespace": "freertos",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon FSx",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 7,
+                    "hour": 13,
+                    "minute": 10,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "fsx",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon GameLift",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 1,
+                    "day": 9,
+                    "hour": 2,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "gamelift",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Glacier",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2016,
+                    "month": 6,
+                    "day": 26,
+                    "hour": 16,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "glacier",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Global Accelerator",
+                "ServiceNamespace": "globalaccelerator",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Glue",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 3,
+                    "day": 12,
+                    "hour": 9,
+                    "minute": 2,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "glue",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Greengrass",
+                "ServiceNamespace": "greengrass",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon GroundTruth Labeling",
+                "ServiceNamespace": "groundtruthlabeling",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon GuardDuty",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 22,
+                    "hour": 20,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "guardduty",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Health APIs and Notifications",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 9,
+                    "hour": 15,
+                    "minute": 41,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "health",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Identity and Access Management",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 13,
+                    "hour": 12,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "iam",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Import Export",
+                "ServiceNamespace": "importexport",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Inspector",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 3,
+                    "day": 20,
+                    "hour": 23,
+                    "minute": 10,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "inspector",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS IoT",
+                "ServiceNamespace": "iot",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS IoT 1-Click",
+                "ServiceNamespace": "iot1click",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS IoT Analytics",
+                "ServiceNamespace": "iotanalytics",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS IoT Events",
+                "ServiceNamespace": "iotevents",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS IoT SiteWise",
+                "ServiceNamespace": "iotsitewise",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Managed Streaming for Kafka",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 1,
+                    "day": 30,
+                    "hour": 16,
+                    "minute": 48,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "kafka",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Kinesis",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "kinesis",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Kinesis Analytics",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 1,
+                    "day": 18,
+                    "hour": 9,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "kinesisanalytics",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Kinesis Video Streams",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 1,
+                    "day": 18,
+                    "hour": 9,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "kinesisvideo",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Key Management Service",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 1,
+                    "hour": 23,
+                    "minute": 20,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "kms",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Lambda",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 9,
+                    "hour": 14,
+                    "minute": 8,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "lambda",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Lex",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 1,
+                    "day": 26,
+                    "hour": 17,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "lex",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS License Manager",
+                "ServiceNamespace": "license-manager",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Lightsail",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 11,
+                    "day": 2,
+                    "hour": 10,
+                    "minute": 18,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "lightsail",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon CloudWatch Logs",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 2,
+                    "hour": 13,
+                    "minute": 11,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "logs",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Machine Learning",
+                "ServiceNamespace": "machinelearning",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Macie",
+                "ServiceNamespace": "macie",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Mechanical Turk",
+                "ServiceNamespace": "mechanicalturk",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Elemental MediaConnect",
+                "ServiceNamespace": "mediaconnect",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Elemental MediaConvert",
+                "ServiceNamespace": "mediaconvert",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Elemental MediaLive",
+                "ServiceNamespace": "medialive",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Elemental MediaPackage",
+                "ServiceNamespace": "mediapackage",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Elemental MediaStore",
+                "ServiceNamespace": "mediastore",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Migration Hub",
+                "ServiceNamespace": "mgh",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Mobile Analytics",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 1,
+                    "day": 8,
+                    "hour": 23,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "mobileanalytics",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Mobile Hub",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 1,
+                    "day": 8,
+                    "hour": 23,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "mobilehub",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Pinpoint",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 1,
+                    "day": 8,
+                    "hour": 23,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "mobiletargeting",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon MQ",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 6,
+                    "day": 29,
+                    "hour": 9,
+                    "minute": 41,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "mq",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Neptune",
+                "ServiceNamespace": "neptune-db",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS OpsWorks",
+                "ServiceNamespace": "opsworks",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS OpsWorks Configuration Management",
+                "ServiceNamespace": "opsworks-cm",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Organizations",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 3,
+                    "hour": 20,
+                    "minute": 14,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "organizations",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Performance Insights",
+                "ServiceNamespace": "pi",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Polly",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 1,
+                    "day": 26,
+                    "hour": 16,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "polly",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Price List",
+                "ServiceNamespace": "pricing",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon QuickSight",
+                "ServiceNamespace": "quicksight",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Resource Access Manager",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 12,
+                    "minute": 56,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "ram",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon RDS",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 21,
+                    "hour": 18,
+                    "minute": 7,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "rds",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Redshift",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 2,
+                    "day": 17,
+                    "hour": 8,
+                    "minute": 34,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "redshift",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Rekognition",
+                "ServiceNamespace": "rekognition",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Resource Groups",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 5,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "resource-groups",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS RoboMaker",
+                "ServiceNamespace": "robomaker",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Route 53",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 1,
+                    "day": 29,
+                    "hour": 3,
+                    "minute": 25,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "route53",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Route53 Domains",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 2,
+                    "day": 17,
+                    "hour": 8,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "route53domains",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Route 53 Resolver",
+                "ServiceNamespace": "route53resolver",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon S3",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 9,
+                    "hour": 14,
+                    "minute": 8,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "s3",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon SageMaker",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 10,
+                    "day": 9,
+                    "hour": 9,
+                    "minute": 10,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "sagemaker",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon SimpleDB",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2016,
+                    "month": 11,
+                    "day": 26,
+                    "hour": 16,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "sdb",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Secrets Manager",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 1,
+                    "hour": 14,
+                    "minute": 35,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "secretsmanager",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Security Hub",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 9,
+                    "hour": 14,
+                    "minute": 47,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "securityhub",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Serverless Application Repository",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 12,
+                    "day": 2,
+                    "hour": 4,
+                    "minute": 51,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "serverlessrepo",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Service Catalog",
+                "ServiceNamespace": "servicecatalog",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Cloud Map",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 11,
+                    "day": 20,
+                    "hour": 17,
+                    "minute": 2,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "servicediscovery",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon SES",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 2,
+                    "day": 17,
+                    "hour": 8,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "ses",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Shield",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 9,
+                    "hour": 14,
+                    "minute": 19,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "shield",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Code Signing for Amazon FreeRTOS",
+                "ServiceNamespace": "signer",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Server Migration Service",
+                "ServiceNamespace": "sms",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Pinpoint SMS and Voice Service",
+                "ServiceNamespace": "sms-voice",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Snowball",
+                "ServiceNamespace": "snowball",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon SNS",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 1,
+                    "hour": 23,
+                    "minute": 20,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "sns",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon SQS",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "sqs",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Systems Manager",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "ssm",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Session Manager Message Gateway Service",
+                "ServiceNamespace": "ssmmessages",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS SSO",
+                "ServiceNamespace": "sso",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS SSO Directory",
+                "ServiceNamespace": "sso-directory",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Step Functions",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "states",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Storage Gateway",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2017,
+                    "month": 1,
+                    "day": 9,
+                    "hour": 2,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "storagegateway",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS Security Token Service",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 13,
+                    "hour": 12,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "sts",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Sumerian",
+                "ServiceNamespace": "sumerian",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Support",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 2,
+                    "day": 6,
+                    "hour": 13,
+                    "minute": 6,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "support",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Simple Workflow Service",
+                "ServiceNamespace": "swf",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Resource Group Tagging API",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 3,
+                    "day": 9,
+                    "hour": 14,
+                    "minute": 8,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "tag",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Textract",
+                "ServiceNamespace": "textract",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon Transcribe",
+                "ServiceNamespace": "transcribe",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Transfer for SFTP",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 1,
+                    "day": 29,
+                    "hour": 12,
+                    "minute": 55,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "transfer",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon Translate",
+                "ServiceNamespace": "translate",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Trusted Advisor",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2019,
+                    "month": 1,
+                    "day": 16,
+                    "hour": 17,
+                    "minute": 14,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "trustedadvisor",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS WAF",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 3,
+                    "day": 29,
+                    "hour": 8,
+                    "minute": 39,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "waf",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "AWS WAF Regional",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 11,
+                    "day": 2,
+                    "hour": 10,
+                    "minute": 19,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "waf-regional",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            },
+            {
+                "ServiceName": "Amazon WorkSpaces Application Manager",
+                "ServiceNamespace": "wam",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS Well-Architected Tool",
+                "ServiceNamespace": "wellarchitected",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon WorkDocs",
+                "ServiceNamespace": "workdocs",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon WorkLink",
+                "ServiceNamespace": "worklink",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon WorkMail",
+                "ServiceNamespace": "workmail",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "Amazon WorkSpaces",
+                "ServiceNamespace": "workspaces",
+                "TotalAuthenticatedEntities": 0
+            },
+            {
+                "ServiceName": "AWS X-Ray",
+                "LastAuthenticated": {
+                    "__class__": "datetime",
+                    "year": 2018,
+                    "month": 12,
+                    "day": 15,
+                    "hour": 4,
+                    "minute": 17,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "ServiceNamespace": "xray",
+                "LastAuthenticatedEntity": "arn:aws:iam::644160558196:user/kapil",
+                "TotalAuthenticatedEntities": 1
+            }
+        ],
+        "JobCompletionDate": {
+            "__class__": "datetime",
+            "year": 2019,
+            "month": 3,
+            "day": 13,
+            "hour": 12,
+            "minute": 56,
+            "second": 11,
+            "microsecond": 192000
+        },
+        "IsTruncated": false,
+        "ResponseMetadata": {
+            "RequestId": "6195d5c0-458f-11e9-a1c2-c103d986345a",
+            "HTTPStatusCode": 200,
+            "HTTPHeaders": {
+                "x-amzn-requestid": "6195d5c0-458f-11e9-a1c2-c103d986345a",
+                "content-type": "text/xml",
+                "content-length": "51629",
+                "vary": "accept-encoding",
+                "date": "Wed, 13 Mar 2019 12:56:12 GMT"
+            },
+            "RetryAttempts": 0
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_user_usage/iam.GetUser_1.json b/tests/data/placebo/test_iam_user_usage/iam.GetUser_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_user_usage/iam.GetUser_1.json
@@ -0,0 +1,48 @@
+{
+    "status_code": 200,
+    "data": {
+        "User": {
+            "Path": "/",
+            "UserName": "kapil",
+            "UserId": "AIDAJEZOTH6YPO3DY45QW",
+            "Arn": "arn:aws:iam::644160558196:user/kapil",
+            "CreateDate": {
+                "__class__": "datetime",
+                "year": 2016,
+                "month": 5,
+                "day": 16,
+                "hour": 19,
+                "minute": 3,
+                "second": 36,
+                "microsecond": 0
+            },
+            "PasswordLastUsed": {
+                "__class__": "datetime",
+                "year": 2019,
+                "month": 3,
+                "day": 9,
+                "hour": 14,
+                "minute": 8,
+                "second": 17,
+                "microsecond": 0
+            },
+            "Tags": [
+                {
+                    "Key": "Role",
+                    "Value": "Contributor"
+                }
+            ]
+        },
+        "ResponseMetadata": {
+            "RequestId": "603fbb23-458f-11e9-a1c2-c103d986345a",
+            "HTTPStatusCode": 200,
+            "HTTPHeaders": {
+                "x-amzn-requestid": "603fbb23-458f-11e9-a1c2-c103d986345a",
+                "content-type": "text/xml",
+                "content-length": "648",
+                "date": "Wed, 13 Mar 2019 12:56:10 GMT"
+            },
+            "RetryAttempts": 0
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_user_usage/iam.GetUser_2.json b/tests/data/placebo/test_iam_user_usage/iam.GetUser_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_user_usage/iam.GetUser_2.json
@@ -0,0 +1,48 @@
+{
+    "status_code": 200,
+    "data": {
+        "User": {
+            "Path": "/",
+            "UserName": "kapil",
+            "UserId": "AIDAJEZOTH6YPO3DY45QW",
+            "Arn": "arn:aws:iam::644160558196:user/kapil",
+            "CreateDate": {
+                "__class__": "datetime",
+                "year": 2016,
+                "month": 5,
+                "day": 16,
+                "hour": 19,
+                "minute": 3,
+                "second": 36,
+                "microsecond": 0
+            },
+            "PasswordLastUsed": {
+                "__class__": "datetime",
+                "year": 2019,
+                "month": 3,
+                "day": 9,
+                "hour": 14,
+                "minute": 8,
+                "second": 17,
+                "microsecond": 0
+            },
+            "Tags": [
+                {
+                    "Key": "Role",
+                    "Value": "Contributor"
+                }
+            ]
+        },
+        "ResponseMetadata": {
+            "RequestId": "604ba1f2-458f-11e9-b668-035dc0b14efe",
+            "HTTPStatusCode": 200,
+            "HTTPHeaders": {
+                "x-amzn-requestid": "604ba1f2-458f-11e9-b668-035dc0b14efe",
+                "content-type": "text/xml",
+                "content-length": "648",
+                "date": "Wed, 13 Mar 2019 12:56:10 GMT"
+            },
+            "RetryAttempts": 0
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/test_iam.py b/tests/test_iam.py
--- a/tests/test_iam.py
+++ b/tests/test_iam.py
@@ -346,6 +346,25 @@ def test_iam_role_actions(self):
 
 class IamUserTest(BaseTest):
 
+    def test_iam_user_usage(self):
+        factory = self.replay_flight_data('test_iam_user_usage')
+        p = self.load_policy({
+            'name': 'usage-check',
+            'resource': 'iam-user',
+            'mode': {
+                'type': 'cloudtrail',
+                'events': [{'event': '', 'source': '', 'ids': 'ids'}]},
+            'filters': [
+                {'UserName': 'kapil'},
+                {'type': 'usage',
+                 'ServiceNamespace': 'dynamodb',
+                 'TotalAuthenticatedEntities': 1,
+                 'poll-delay': 0.1,
+                 'match-operator': 'any'}]}, session_factory=factory)
+        resources = p.push({'detail': {
+            'eventName': '', 'eventSource': '', 'ids': ['kapil']}}, None)
+        self.assertEqual(len(resources), 1)
+
     def test_iam_user_check_permissions(self):
         factory = self.replay_flight_data('test_iam_user_check_permissions')
         p = self.load_policy({