Amazon IAM Access Analyzer
AWS IAM Access Analyzer helps you set, verify, and refine your IAM policies by providing a suite of capabilities including findings for external, internal, and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. It uses automated reasoning to identify resources shared with external entities and helps implement least privilege access across your AWS environment.
APIs
AWS IAM Access Analyzer API
The AWS IAM Access Analyzer API provides programmatic access to create and manage analyzers, findings, archive rules, and policy validations to identify and remediate unintended...
Capabilities
Amazon IAM Access Analyzer - Access Security Management
Unified capability for security teams to manage access analyzers, review findings, validate policies, and enforce least-privilege access controls across AWS accounts.
Run with NaftikoFeatures
Identifies resources shared with external entities outside your AWS organization using automated reasoning.
Identifies which principals within your organization have access to selected resources.
Identifies unused IAM roles, access keys, console passwords, and unused service permissions.
Validates IAM policies against best practices and custom security standards before deployment.
Generates fine-grained IAM policies based on actual access activity logged in AWS CloudTrail.
Preview public and cross-account access to resources before deploying permission changes.
Automatically archive findings that match specified criteria to reduce noise.
Use Cases
Analyze actual API activity to generate minimal permission policies that implement least privilege access.
Continuously monitor for unintended external access to sensitive resources like S3 buckets and IAM roles.
Integrate policy checks into deployment pipelines to catch overpermissive policies before they reach production.
Identify and remediate unused access across IAM users, roles, and service accounts organization-wide.
Identify all resources shared across AWS accounts and validate the intent of each cross-account permission.
Integrations
Uses CloudTrail activity logs to generate least-privilege IAM policies based on actual usage.
Publishes Access Analyzer findings to Security Hub for centralized security monitoring.
Analyzes access across all accounts in an AWS Organization for comprehensive governance.
Triggers re-scanning of resources when configuration changes are detected.
Publishes finding events to EventBridge for automated security workflow responses.