Access Analyzer
IAM Access Analyzer answers two questions about permissions: which resources can be reached from outside the organization, and which roles, users and permissions have not been used in a long time. The platform runs one analyzer of each kind.
What it does
An external access analyzer reads the resource policies on buckets, KMS keys, roles, queues, secrets and similar resources, and reports every case where a principal outside the chosen zone of trust (an account or a whole organization) is granted access. It reasons about the policies mathematically rather than by testing requests, so it finds grants that nobody has exercised yet. An unused access analyzer watches activity instead: it reports roles and users with no activity for a chosen number of days, unused access keys and passwords, and permissions that were granted but never used. Each result is a finding.
How BuiltForProd uses it
The two analyzers are split across two accounts and two units that share modules/access-analyzer:
| Analyzer | Unit | Account | Setting |
|---|---|---|---|
| External access, organization zone of trust | access-analyzer-org | core-root | Always on; no charge |
| Unused access, 90 days | access-analyzer | core-security | enable_unused_access_analyzer = true and unused_access_age_days = 90 in environments/core/security/security.hcl; about $0.20 per IAM role or user analyzed per month |
The organization analyzer lives in the management account because that is where the organization is the zone of trust. Anything a bucket policy, key policy or role trust policy shares with an account outside the organization shows up as a finding. In the platform, the expected cross-account grants (the audit bucket's organization-wide read policy, the shared artifact bucket, the ECR pull permissions, the cross-account roles in core-dns, core-network and core-auto) stay inside the organization and therefore do not appear.
The unused access analyzer is the control that backs the platform's least-privilege stance over time. A role that no pipeline or person has assumed in 90 days, or a permission that was granted but never exercised, becomes a finding to review.
Security Hub always imports Access Analyzer findings; unlike the other integrations, this one does not follow a switch because the organization analyzer is always present. The SecurityAuditorAccess permission set may list analyzers and read findings in every account.
Terms you will see
| Term | Meaning |
|---|---|
| Zone of trust | The boundary (account or organization) that access is analyzed against. |
| External access finding | A resource whose policy grants access to a principal outside the zone of trust. |
| Unused access finding | A role, user, key, password or permission unused for the configured period. |
| Unused access age | The threshold in days; 90 in the platform. |
| Resource policy | The policy attached to a resource, such as a bucket or key policy, that the analyzer reads. |
| Archive rule | A saved filter that automatically archives expected findings; the platform defines none. |
Where to read more
- AWS Baseline overview for the security services in context.
- IAM for the roles the unused access analyzer watches.
- S3 for the bucket policies the external analyzer reads.