How to determine if an IAM user has only API key access (no console access)?

Here’s some psuedocode for what I’d like to do:

for user in iam.users.all():
    if user.password_enabled:
        #Do something

In the credentials report, there’s a field for password_enabled. What’s the equivalent property of an IAM user object?

If such a thing doesn’t exist, I am requesting one.

Thanks!

[jonathanwcrane]

Update. This is the code I got working.

https://gist.github.com/jonathanwcrane/68ddff397ec85a8dddae

[glnds]

If your users (or AWS account) are created after October 20th, 2014 then the code below should do the trick. See the docs for more info: http://boto3.readthedocs.io/en/latest/reference/services/iam.html#IAM.User.password_last_used

It makes the code far less verbose 😉

for iam_user in iam.users.all():      
    if iam_user.password_last_used:
        print('User has console access')
    else:
        print('User has only programmatic access')