duo-labs/cloudtracker ? reverse-engineered prompt

Build me a command line tool that helps me spot AWS IAM users and roles that have more permissions than they actually use.

I want to point it at a CloudTrail log bucket and a saved IAM export for one or more accounts, then have it compare what permissions exist now against what actions were really used. It should let me list users or roles, show which ones look inactive, and show a more detailed view for a specific user or role with used, unused, unknown, and previously used actions clearly marked.

Use a simple YAML config file for the account and Athena settings, and make it work from the terminal with commands like listing users and showing activity for a named user. If there are helpful docs or current AWS setup details I should know, look them up online as needed. I also want it to feel practical for real AWS accounts, including multiple accounts if that is supported.