AWS IAM Access Analyzer
IAM access analysis
Uses logical reasoning to find resources (S3, KMS keys, IAM roles…) shared outside your account/organization, detect unused permissions, validate policies, and generate least-privilege policies from CloudTrail.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?A little
- Serverless
- In examsSAA · SOA · DVA
Think of it asLike an auditor going around checking who is holding keys they don't need.
When to use it
✓ Use it when
You want to tighten permissions to least privilege and detect unintended sharing.
✗ Avoid it when
You need general configuration assessment (not just permissions) → Config.
Common uses
- Detect S3 buckets shared with unknown accounts
- Find long-unused roles/keys
- Validate policies in a CI/CD pipeline
What does it cost?
- Pricing model: External access analysis is free; the unused access analyzer and custom policy checks are charged by the number of IAM roles/users or the number of checks.
Related services
SAA-C03 study guide
Access Analyzer is covered in these study modules: