IAM Access Analyzer

aws Policy engineaws-iam-access-analyzer

Analyses policies to report external, internal and unused access, and validates policies before deployment.

Provider: aws
Kind: Policy engine
Category: Operations
Official docs: https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html

Properties · 5 set by this component

property	type	values	required	kind default	this component
analyzerType · component property	enum	external-access \| internal-access \| unused-access	no	external-access	inherited
effect	enum	audit \| deny \| modify \| deploy-if-not-exists	no	—	▸ audit
enforcementMode	enum	enforced \| disabled	no	—	▸ enforced
managed	boolean	—	no	false	▸ true
policyCount	integer	—	no	—	inherited
policyGeneration · component property	boolean	—	no	false	inherited
policyReanalysisMinutes · component property	integer	—	no	30	inherited
policyValidation · component property	boolean	—	no	true	inherited
regionScoped · component property	boolean	—	no	true	inherited
remediation	boolean	—	no	false	▸ false
scope	enum	resource \| group \| account \| organization	no	—	▸ account
unusedAccessTrackingPeriodDays · component property	integer	—	no	—	inherited

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "iam-access-analyzer", component: "aws-iam-access-analyzer" }

Other Policy engine products · 56

Cloud Configalibaba-cloud-configalibabacloudpolicy-engine Data Security Centeralibaba-data-security-centeralibabacloudpolicy-engine Amazon CodeGuru Revieweraws-codeguru-reviewerawspolicy-engine AWS Configaws-configawspolicy-engine AWS Control Toweraws-control-towerawspolicy-engine AWS Lake Formationaws-lake-formationawspolicy-engine AWS License Manageraws-license-managerawspolicy-engine AWS Organizationsaws-organizationsawspolicy-engine AWS Resource Access Manageraws-ramawspolicy-engine Amazon Verified Permissionsaws-verified-permissionsawspolicy-engine Microsoft Entra Conditional Accessazure-conditional-accessazurepolicy-engine Azure Policyazure-policyazurepolicy-engine Microsoft Entra Privileged Identity Managementazure-privileged-identity-managementazurepolicy-engine Cloudflare Data Loss Preventioncloudflare-dlpcloudflarepolicy-engine CalypsoAIcalypsoaipolicy-engine Cerboscerbospolicy-engine OPA Gatekeepergatekeeperpolicy-engine Guardrails AIguardrails-aipolicy-engine HiddenLayer AI Security Platformhiddenlayerpolicy-engine KubeArmorkubearmorpolicy-engine Kubewardenkubewardenpolicy-engine Kyvernokyvernopolicy-engine Lakera Guardlakera-guardpolicy-engine LLM Guardllm-guardpolicy-engine NeMo Guardrailsnemo-guardrailspolicy-engine Open Policy Agentopapolicy-engine Permit.iopermit-iopolicy-engine Generic policy enginepolicy-enginepolicy-engine Prompt Securityprompt-securitypolicy-engine Protect AIprotect-aipolicy-engine Rebuffrebuffpolicy-engine Robust Intelligencerobust-intelligencepolicy-engine SonarQube Serversonarqubepolicy-engine DigitalOcean CSPMdigitalocean-cspmdigitaloceanpolicy-engine Access Context Managergoogle-access-context-managergcppolicy-engine Assured Workloadsgoogle-assured-workloadsgcppolicy-engine Binary Authorizationgoogle-binary-authorizationgcppolicy-engine Identity and Access Managementgoogle-cloud-iamgcppolicy-engine Firebase App Checkgoogle-firebase-app-checkgcppolicy-engine Model Armorgoogle-model-armorgcppolicy-engine

and 16 more → Policy engine page

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# IAM Access Analyzer: reasons over resource-based and identity policies and reports findings; it
3# reports, it does not block. "Using AWS Identity and Access Management Access Analyzer": you create
4# an analyzer whose zone of trust is one account or the organization, an added or changed policy is
5# re-analyzed within about 30 minutes and everything else on a periodic scan within 24 hours, and an
6# external access analyzer only covers resources in the Region where it was created. Policy
7# validation against grammar and AWS best practices comes with the service.
8# "Create an IAM Access Analyzer unused access analyzer": the tracking period is 1 to 365 days.
9schemaVersion: "1"
10type: "component"
11id: "aws-iam-access-analyzer"
12kind: "policy-engine"
13provider: "aws"
14docs: "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html"
15defaults:
16  effect: "audit"
17  enforcementMode: "enforced"
18  scope: "account"
19  remediation: false
20  managed: true
21properties:
22  analyzerType:
23    type: "enum"
24    values: ["external-access", "internal-access", "unused-access"]
25    default: "external-access"
26  policyValidation:
27    type: "boolean"
28    default: true
29  policyGeneration:
30    type: "boolean"
31    default: false
32  regionScoped:
33    type: "boolean"
34    default: true
35  unusedAccessTrackingPeriodDays:
36    type: "integer"
37  policyReanalysisMinutes:
38    type: "integer"
39    default: 30

The same page as markdown, for an agent: /catalogue/components/aws-iam-access-analyzer.md