I am trying to identify the source of programmatic access for an IAM user’s access key that shows regular activity (e.g., last used 1 hour ago, 30 minutes ago etc.). Despite replacing this key, the activity persists. After extensive research, I found in the IAM credential report that this key is being used for DynamoDB operations and on dashboard it is marked as ‘Programmatic access with active access key.’
I have reviewed all the places where our application accesses DynamoDB, but I am still unable to pinpoint where this specific access key is being utilized. How can I accurately locate the service that is using this IAM access key for DynamoDB access?

I have tried the following steps to locate the usage of the IAM access key:
Credential Report: Generated an IAM credential report to confirm the access key’s activity.
Code Review: Checked all application codebases and configuration files for the old access key.
Replaced Key: Replaced the access key, expecting the activity to stop.
Despite these efforts, the access key activity continues, indicating that it is still being used somewhere in our system. I expected to find and remove the old key from all locations, but the activity persists. Any suggestions on how to accurately locate and stop the usage of this IAM access key would be greatly appreciated.