AWS Key Usage Detector is a security analysis tool designed to identify off-instance key usage patterns within AWS environments. The tool operates by examining CloudTrail log files stored in local directories to detect potentially unauthorized or suspicious access key activities. The application functions as a command-line utility that requires users to clone the repository and install the package before execution. Once configured, users can run the program by specifying the path to their CloudTrail files for analysis. The tool focuses specifically on detecting key usage that occurs outside of expected AWS instances, which can indicate compromised credentials, unauthorized access attempts, or security policy violations. This capability makes it useful for security teams conducting forensic analysis or routine security audits of their AWS infrastructure. The detector processes CloudTrail data locally, allowing organizations to analyze their AWS access patterns without transmitting sensitive log data to external services. This approach supports compliance requirements and maintains data privacy during security investigations.