IAM Access Analyzer
Identity & AccessIAM Access Analyzer helps you identify resources in your account that are shared with an external entity. It uses automated reasoning (mathematical proofs) to analyze resource-based policies on S3 buckets, IAM roles, KMS keys, Lambda functions, SQS queues, and Secrets Manager secrets.
Key Features
- External Access Findings: flags resources accessible from outside your account or organization
- Unused Access Analysis: identifies unused roles, unused access keys, unused permissions, and unused services
- Policy Generation: generates least-privilege policies based on CloudTrail access activity
- Policy Validation: checks policies against AWS best practices and grammar rules
- Custom Policy Checks: validate policies against your security standards before deployment
How It Works
Access Analyzer uses Zelkova, an automated reasoning engine, to mathematically prove whether a policy grants access to external principals. This is not pattern matching - it's formal verification, guaranteeing no false negatives for supported resource types.
Related AWS Services
Related Content
Related Terms
A JSON document that defines permissions - which actions are allowed or denied on which AWS resources, and under what conditions.
The security principle of granting only the minimum permissions needed to perform a task - no more, no less.
A policy attached directly to an AWS resource (S3 bucket, SQS queue, KMS key) that defines who can access it, including principals from other accounts.
A resource-based policy attached to an IAM role that defines which principals (users, services, accounts) are allowed to assume that role.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.