IAM Access Analyzer is enabled

Check ID: accessanalyzer_enabled
Provider: AWS
Service: accessanalyzer
Severity: LOW
Categories: identity-access, trust-boundaries
Resource type: Other

What this check verifies

IAM Access Analyzer presence and status are evaluated per account and Region. An analyzer in ACTIVE state indicates continuous analysis of supported resources and IAM activity to identify external, internal, and unused access.

Risk

Without an active analyzer, visibility into unintended public, cross-account, or risky internal access is lost. Adversaries can exploit exposed S3, snapshots, KMS keys, or permissive role trusts for data exfiltration and escalation. Unused permissions persist, enlarging the attack surface. This degrades confidentiality and integrity.

Recommendation

Enable IAM Access Analyzer across all accounts and active Regions (or organization-wide). Operate on least privilege: continuously review findings, remove unintended access, and trim unused permissions. Use archive rules sparingly, integrate reviews into change/CI/CD workflows, and enforce separation of duties on policy changes.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws accessanalyzer create-analyzer —analyzer-name example_resource —type ACCOUNT

resource "aws_accessanalyzer_analyzer" "example_resource" {
  analyzer_name = "example_resource"
  type          = "ACCOUNT" # This line fixes the security issue
}

Resources:
  example_resource:
    Type: AWS::AccessAnalyzer::Analyzer  # This resource enables IAM Access Analyzer
    Properties:
      AnalyzerName: example_resource
      Type: ACCOUNT  # This line fixes the security issue

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = accessanalyzer_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS checks IAM Access Analyzer is active with no active findings

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires