How to export your machine identities

One export per system is enough to start. Each takes a few minutes, needs read-only access, and contains names and metadata, not secret values.

AWS IAM credential report

In the IAM console open Credential report and download it, or run aws iam generate-credential-report then aws iam get-credential-report --query Content --output text | base64 --decode > report.csv. Upload the CSV as it is. IAM users with console access and no keys are skipped as people.

Reference: AWS IAM credential report documentation

Microsoft Entra ID app registrations or service principals

Export app registrations with Microsoft Graph PowerShell (Get-MgApplication -All) to CSV with the columns DisplayName, AppId, CreatedDateTime, Owners, Permissions, SecretStartDateTime and SecretEndDateTime. Add LastSignInDateTime from service principal sign-in activity if you have it.

Reference: Microsoft Entra ID app registrations or service principals documentation

Okta API tokens

Paste the JSON returned by GET /api/v1/api-tokens (Security › API › Tokens lists the same tokens). Okta documents that API tokens inherit the privilege level of the admin who created them, so every token is checked as privileged.

Reference: Okta API tokens documentation

GitHub fine-grained personal access tokens (organization)

Paste the JSON from gh api /orgs/ORG/personal-access-tokens --paginate (fine-grained tokens with access to your organization).

Reference: GitHub fine-grained personal access tokens (organization) documentation

Google Cloud service account keys

Paste the JSON from gcloud iam service-accounts keys list --iam-account=SA_EMAIL --format=json, or the same fields as CSV. Google-managed keys are rotated by Google and aren't flagged for age.

Reference: Google Cloud service account keys documentation

Google Workspace domain-wide delegation

In the Admin console, domain-wide delegation lists each client's ID, name and OAuth scopes. Put them in a CSV with the columns Client ID, Name and OAuth scopes.

Reference: Google Workspace domain-wide delegation documentation

Everything else

Secrets managers, CI/CD systems and SaaS admin consoles usually export a list of tokens or integrations. Any CSV with a header row works: include name, owner, privilege or scopes, last used, created or rotated, and expiry where you have them.

Audit an export