Absolutely, I worked at a place where we generated unique aws tokens, pushing it out to all users/computers in the fleet and had alerting anytime one was used,

Absolutely, I worked at a place where we generated unique aws tokens, pushing it out to all users/computers in the fleet and had alerting anytime one was used, which was traceable to a service, user or server. Within 1 year I found a breach on a developers box and another on a frontend server.