Check ID: accessanalyzer_enabled_without_findings
Provider: AWS
Service: accessanalyzer
Severity: LOW
Categories: identity-access, trust-boundaries, internet-exposed
Resource type: Other

​
What this check verifies

IAM Access Analyzer analyzers are in Active state and currently report zero Active findings within their scope of monitored resources.

​
Risk

Unresolved Active findings indicate unintended external or internal access paths.
  • Confidentiality: public/cross-account reads of data (buckets, snapshots, secrets)
  • Integrity: rogue role assumption or KMS use enabling policy/data changes
  • Lateral movement across accounts

​
Recommendation

Enable IAM Access Analyzer in all relevant Regions and org/account scopes. Triage every Active finding:
  • Remove unintended access by tightening resource and trust policies
  • Enforce least privilege and separation of duties
  • Archive only validated, intended access
  • Continuously monitor and automate reviews

​
Remediation

resource "aws_accessanalyzer_analyzer" "example_resource" {
  analyzer_name = "example_resource"
  type          = "ACCOUNT" # This line fixes the security issue
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = accessanalyzer_enabled_without_findings. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks