Detecting Excessive Permissions with IAM Access Analyzer - External Access and Unused Permission Analysis
Detect unused permissions on IAM roles using CloudTrail-based analysis and auto-generate least-privilege policies. This guide covers external access detection and integrating custom policy checks into your CI/CD pipeline.
Overview of Access Analyzer
IAM Access Analyzer is a service that detects access permission issues using two types of analyzers. The external access analyzer examines resource policies on S3 buckets, IAM roles, and other resources to identify configurations that allow access from accounts outside your organization or from the public. The unused access analyzer cross-references CloudTrail activity logs with IAM role permissions to detect permissions that are not actually being used. It also provides a feature that auto-generates least-privilege IAM policies based on past CloudTrail activity, along with custom policy checks that can be integrated into CI/CD pipelines.
Unused Permissions and Policy Generation
The unused access analyzer compares IAM role and user permissions against CloudTrail activity to detect actions not used for 90 days or more, unused access keys, and unused roles. The 90-day period is the default value, so you need to account for batch processes that only run quarterly to avoid false positives. Policy generation automatically creates least-privilege IAM policies containing only the actions actually used, based on the past 90 days of CloudTrail activity. Rather than applying generated policies as-is, review them to ensure they include actions that may be needed in the future before applying. Custom policy checks can be integrated into CI/CD pipelines to automatically verify that IAM policy changes do not grant specific actions such as s3:* or iam:*. A common pattern is to place a Lambda function in a CodePipeline stage that uses the CheckNoNewAccess API to verify the safety of policy changes.
Leveraging External Access Detection
The external access analyzer examines S3 bucket policies, IAM role trust policies, KMS key policies, Lambda function policies, and SQS queue policies to detect resources accessible from external accounts or the public. Findings are classified as archived (intentional sharing) or active (requires action), allowing you to prioritize fixing unintended external exposure. Custom policy checks can automatically verify in CI/CD pipelines that policy changes do not introduce new external access. Integration with Organizations enables centralized management of external access across all accounts, providing visibility into the security posture of the entire organization. To deepen your understanding of IAM security, specialized books on Amazon can also be helpful.
Access Analyzer Pricing
The external access analyzer is available at no charge. The unused access analyzer is billed based on the number of IAM roles and users analyzed, at approximately $0.20 per role/user per month. Custom policy checks cost approximately $0.002 per check. In large-scale environments with many IAM entities, unused access analyzer costs can add up, so a phased rollout starting with critical accounts is recommended. The external access analyzer can be enabled at no cost across all accounts and is essential as a security baseline.
Summary
Access Analyzer is a service that enforces the principle of least privilege through external access and unused permission detection. It efficiently configures appropriate permissions via CloudTrail-based automatic policy generation, and automates the entire permission management lifecycle by integrating security verification into CI/CD pipelines through custom policy checks.