Detecting Excessive Access Permissions with IAM Access Analyzer - Analyzing External Access and Unused Permissions
Detect unused permissions on IAM roles based on CloudTrail and automatically generate least-privilege policies. This article explains external access detection and how to build custom policy checks into CI/CD.
Overview of Access Analyzer
IAM Access Analyzer is a service that detects access permission problems, with analyzers that analyze external access, unused access, and more. The external access analyzer analyzes resource policies on resources such as S3 buckets and IAM roles, and identifies settings that allow access from accounts outside the organization or from the public. The unused access analyzer compares CloudTrail activity logs with the permissions of IAM roles and detects permissions that are not actually being used. In addition, it provides a feature that automatically generates least-privilege IAM policies based on past CloudTrail activity, and a custom policy check feature that you build into CI/CD pipelines.
Unused Permissions and Policy Generation
The unused access analyzer compares the permissions of IAM roles and users with CloudTrail activity, and detects actions that have not been used within a period you set (for example, 90 days), unused access keys, and unused roles. The 90-day period is the default value, and to avoid false positives for things like batch jobs that run only once a quarter, you need to operate it with the analysis period in mind. Policy generation automatically generates a least-privilege IAM policy that contains only the actions actually used, based on CloudTrail activity over a specified period of up to 90 days. Rather than applying the generated policy as is, you review whether it includes actions that will be needed in the future before applying it. Custom policy checks are built into CI/CD pipelines to automatically verify that changes to IAM policies do not allow specific actions (s3:* or iam:*). One pattern is to place a Lambda function in a CodePipeline stage and verify policy changes with the CheckNoNewAccess API.
Using External Access Detection
The external access analyzer analyzes S3 bucket policies, IAM role trust policies, KMS key policies, Lambda function policies, and SQS queue policies, and detects resources that can be accessed from external accounts or from the public. You classify findings as archived (intentional sharing) or active (action required), and fix unintended external exposure first. With custom policy checks, you can automatically verify in CI/CD pipelines that policy changes do not allow new external access. Integration with Organizations lets you centrally manage external access across all accounts and visualize the security posture of the entire organization.
Access Analyzer Pricing
The external access analyzer is available at no charge. The unused access analyzer is billed based on the number of IAM roles and users analyzed, at about $0.20 per role/user per month (as of August 2026). Custom policy checks cost about $0.002 per check. Because the cost of the unused access analyzer adds up in large environments with many IAM entities, one approach is to enable it in stages, starting with the accounts you prioritize. The external access analyzer can be enabled in all accounts at no charge and can be used as a security baseline.
The Cycle for Achieving Least Privilege
Good permission design is not a one-time task but something you keep refining. Access Analyzer analyzes the actual access history and identifies permissions that are not being used. Based on this, you can remove permissions that have been granted too broadly and narrow them down to only what is actually needed. In addition, there is a feature that generates a draft policy containing only the necessary permissions, based on past activity. You can use this as a starting point and adjust it to create a least-privilege policy. You run the grant / analyze / reduce cycle regularly to keep permissions from spreading and move closer to a least-privilege state.
Policy Validation Before Deployment
You can check for permission problems before a policy is applied to production. Access Analyzer provides a feature that validates, before you apply a policy, whether the policy you created allows excessive access contrary to your intent. For example, it detects and warns about settings that would expose a resource to external accounts and about non-recommended ways of writing policies. If you build this into a CI/CD pipeline, policy changes can be checked automatically before they are merged into the repository, which can reduce the chance of dangerous permission settings flowing into production. You make pre-deployment validation part of your process and build it into ongoing permission management.
Summary
Access Analyzer is a service you use for permission management in line with the principle of least privilege, by detecting external access and unused permissions. You set permissions with automatic policy generation based on CloudTrail activity, build security validation into CI/CD pipelines with custom policy checks, and automate the lifecycle of permission management.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- IAM Access Analyzer official page
- AWS IAM official page
- AWS CloudTrail official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.