Getting started with AWS IAM Access Analyzer

Use the information in this topic to learn about the requirements necessary to use and manage AWS IAM Access Analyzer, and then how to enable Access Analyzer. To learn more about the service-linked role for Access Analyzer, see Using service-linked roles for AWS IAM Access Analyzer.

Permissions required to use Access Analyzer

To successfully configure and use Access Analyzer, the account you use must be granted the required permissions. To access and use all Access Analyzer features, you can apply the IAMAccessAnalyzerFullAccess managed policy to the account. The full access policy grants the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "access-analyzer:*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "access-analyzer.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "organizations:DescribeAccount",
        "organizations:DescribeOrganization",
        "organizations:DescribeOrganizationalUnit",
        "organizations:ListAccounts",
        "organizations:ListAccountsForParent",
        "organizations:ListAWSServiceAccessForOrganization",
        "organizations:ListChildren",
        "organizations:ListDelegatedAdministrators",
        "organizations:ListOrganizationalUnitsForParent",
        "organizations:ListParents",
        "organizations:ListRoots"
      ],
      "Resource": "*"
    }
  ]
}

A custom policy for managing Access Analyzer must include the following permissions:

To allow read-only access to Access Analyzer, use the IAMAccessAnalyzerReadOnlyAccess managed policy. This policy grants the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "access-analyzer:Get*",
        "access-analyzer:List*"
      ],
      "Resource": "*"
    }
  ]
}

If you plan to use Access Analyzer for an organization in AWS Organizations, you need to enable trusted access for Access Analyzer in AWS Organizations. You also need the following permissions:

Resources defined by AWS IAM Access Analyzer

Access Analyzer defines the following resources:

Required Access Analyzer service permissions

Access Analyzer uses a service-linked role named AWSServiceRoleForAccessAnalyzer to grant the service read-only access to analyze AWS resources with resource-based policies on your behalf. When you create an analyzer with your account as the zone of trust, the service creates the role your account. When you create an analyzer with your organization as the zone of trust, the service creates a roll in each account that belongs to your organization. For more information, see Using service-linked roles for AWS IAM Access Analyzer.

In some cases, after you enable Access Analyzer, the Findings page loads with no findings. This might be due to a delay in the console for populating your findings. You need to manually refresh the browser to view your findings. If you still don't see any findings, it's because you have no supported resources in your account that can be accessed by an external entity. If a policy that grants access to an external entity is applied to a resource, Access Analyzer generates a finding.

Enabling Access Analyzer

To enable Access Analyzer in a Region, you must create an analyzer in that Region. You must create an analyzer in each Region in which you want to monitor access to your resources.

When you create an analyzer to enable Access Analyzer, a service-linked role named AWSServiceRoleForAccessAnalyzer is created in your account.

When you create an analyzer with the organization as the zone of trust, a service-linked role named AWSServiceRoleForAccessAnalyzer is created in each account of your organization.

Access Analyzer status

To view the status of your analyzers, choose Analyzers. Analyzers created for an organization or account can have the following status:

Access Analyzer quotas

Access Analyzer has the following quotas:

* Some quotas are customer-configurable using Service Quotas.