Lesson 13 — IAM Access Analyzer

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 02 – Identity & Access Management (IAM)

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand AWS IAM Access Analyzer.
Identify unintended external access.
Validate IAM Policies.
Analyze resource sharing risks.
Review security findings.
Apply enterprise security best practices.
Use IAM Access Analyzer to improve cloud governance.

📚 Lesson Information

Estimated Time: 3–4 Hours

Difficulty: Intermediate

Prerequisites: Lesson 12 – Cross-Account Access

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

One of the biggest challenges in cloud security is knowing who actually has access to your resources.

Over time, organisations create:

IAM Users
IAM Roles
Resource Policies
Cross-Account Access
Shared S3 Buckets
KMS Keys
Secrets
Lambda Functions

As cloud environments grow, permissions become increasingly difficult to track.

AWS IAM Access Analyzer continuously analyzes resource policies and identifies unintended access before it becomes a security incident.

🏢 In the Company

CloudNova Technologies recently completed a security audit.

The auditors discovered:

An S3 bucket shared with another AWS account.
A KMS key accessible by an external account.
Several IAM Roles trusted by unknown AWS accounts.
An old Lambda function that was publicly accessible.

Management was unaware of these permissions.

The CISO asks the Cloud Security Team to deploy AWS IAM Access Analyzer to continuously monitor resource access.

🌍 What is IAM Access Analyzer?

AWS IAM Access Analyzer is a security service that helps identify resources shared with external identities.

It continuously evaluates resource policies and generates findings whenever access is granted outside your AWS Organization or account.

Instead of manually reviewing hundreds of policies, Access Analyzer automatically detects potential security risks.

🔍 What Does Access Analyzer Monitor?

IAM Access Analyzer can evaluate access to services such as:

Amazon S3
AWS KMS
IAM Roles
AWS Secrets Manager
Amazon SQS
Amazon SNS
AWS Lambda
Amazon EFS
Amazon ECR
AWS Organizations resources

As AWS adds support for additional services, Access Analyzer continues to expand its coverage.

🏗 How IAM Access Analyzer Works

AWS Resources

        │

Resource Policies

        │

IAM Access Analyzer

        │

Analyze Permissions

        │

Generate Findings

        │

Security Team Reviews

        │

Remediate Risks

🔐 What Is a Finding?

A Finding is a notification that a resource may be accessible by an external principal.

Examples include:

Public S3 Bucket
External AWS Account Access
Cross-Account IAM Role
Public Lambda Function
External KMS Key Access

Each finding includes enough information to investigate and remediate the issue.

🏢 Enterprise Example

CloudNova stores confidential customer reports in an Amazon S3 bucket.

During a routine review, IAM Access Analyzer reports:

External Access Detected

Resource:
Customer-Reports

Accessible By:
AWS Account 123456789012

The Security Team investigates and discovers that a contractor’s AWS account still has access even though the project ended months ago.

The access is removed before any data is exposed.

🛡 Types of Access Findings

IAM Access Analyzer commonly detects:

Finding	Description
Public Access	Resource accessible from the internet
Cross-Account Access	Another AWS account has access
External Principal	Access granted outside the organization
Shared Resource	Resource intentionally shared
Unused Access	Permissions that are never used (where applicable with related IAM analysis features)

Not every finding represents a vulnerability, but every finding should be reviewed.

📊 Benefits of IAM Access Analyzer

Continuous monitoring
Automatic policy analysis
Improved visibility
Reduced security risks
Easier compliance
Faster security audits
Better governance
Supports Least Privilege

🚫 Common Mistakes

Avoid:

❌ Ignoring Access Analyzer findings.

❌ Leaving public S3 buckets enabled.

❌ Sharing IAM Roles unnecessarily.

❌ Forgetting to remove contractor access.

❌ Assuming every shared resource is intentional.

✅ Enterprise Best Practices

Enable IAM Access Analyzer in every AWS Region used by your organisation.
Review findings regularly.
Investigate unexpected external access immediately.
Remove unnecessary sharing.
Follow Least Privilege.
Integrate findings into security operations.
Periodically review trusted external accounts.

🧪 Enterprise Mission 01 — Open IAM Access Analyzer

Navigate to:

AWS Console

↓

IAM

↓

Access Analyzer

Review:

Existing Analyzers
Findings
Resource Types

Document your observations.

🧪 Enterprise Mission 02 — Create an Analyzer

If an Analyzer does not already exist:

Navigate to:

IAM

↓

Access Analyzer

↓

Create Analyzer

Choose:

Organization

Account

depending on your AWS environment.

Provide an appropriate name and create the Analyzer.

🧪 Enterprise Mission 03 — Review Findings

Open:

IAM

↓

Access Analyzer

↓

Findings

Review:

Resource Name
Resource Type
External Principal
Finding Status
Last Updated

Record your observations.

🧪 Enterprise Mission 04 — Investigate an S3 Bucket

Select a finding involving an Amazon S3 bucket.

Review:

Bucket Policy
External Access
Public Access Settings

Determine whether the access is:

Intended
Unintended

Document your conclusion.

🧪 Enterprise Mission 05 — Validate an IAM Policy

Navigate to:

IAM

↓

Policies

↓

Select Policy

↓

Validate Policy

Review:

Security Warnings
Best Practice Recommendations
Policy Errors

Update the policy if required.

🧪 Enterprise Mission 06 — Review IAM Roles

Navigate to:

IAM

↓

Roles

Review:

Trust Policies
External Accounts
Attached Permissions

Determine whether any role grants unnecessary external access.

🧪 Enterprise Mission 07 — Security Investigation

CloudNova receives the following finding:

External Access Detected

Resource:
CloudNova-Backup

Principal:
AWS Account 987654321098

Investigate:

Why does the external account have access?
Is the access still required?
Which policy granted the access?
Should the finding be resolved?

Document your investigation.

🧪 Enterprise Mission 08 — Enterprise Design Exercise

CloudNova operates:

20 AWS Accounts
500 IAM Roles
150 S3 Buckets
60 KMS Keys
40 Lambda Functions

Design a process for:

Reviewing findings
Prioritising risks
Escalating security incidents
Remediating external access
Reporting compliance

🏢 Enterprise Scenario

During an annual compliance audit, CloudNova’s auditors ask:

“Can you prove that no sensitive resources are unintentionally shared with external AWS accounts?”

The Security Team uses IAM Access Analyzer findings to demonstrate:

Continuous monitoring
External access detection
Regular security reviews
Timely remediation of security findings

Prepare a response explaining how IAM Access Analyzer supports compliance and governance.

📊 Knowledge Check

What is AWS IAM Access Analyzer?
What is a finding?
Which AWS resources can IAM Access Analyzer evaluate?
Why is external access monitoring important?
What is the difference between intended and unintended access?
Which AWS console section displays Access Analyzer findings?
Why should findings be reviewed regularly?
How does IAM Access Analyzer support Least Privilege?
Why is policy validation useful?
How does IAM Access Analyzer improve enterprise security?

📝 Assignment

Prepare an AWS IAM Access Analyzer Implementation Guide.

Include:

IAM Access Analyzer Overview
Supported Resource Types
Findings
Policy Validation
Enterprise Investigation Process
Best Practices
Security Benefits
Screenshots
Lessons Learned

Length: 5–6 Pages

📋 Lesson Completion Checklist

Task	Status
Opened IAM Access Analyzer	☐
Created an Analyzer	☐
Reviewed Findings	☐
Investigated an S3 Bucket	☐
Validated an IAM Policy	☐
Reviewed IAM Roles	☐
Completed Security Investigation	☐
Completed Enterprise Design	☐
Completed Assignment	☐

💡 Key Takeaways

After completing this lesson, you should understand:

AWS IAM Access Analyzer continuously analyzes resource policies to detect unintended external access.
Findings help identify resources that are publicly accessible or shared with external AWS accounts.
Policy validation helps detect configuration errors and security best practice violations before deployment.
Regular review of Access Analyzer findings strengthens governance, supports compliance and reduces security risks.
IAM Access Analyzer is an essential service for maintaining visibility into resource sharing across enterprise AWS environments.

📚 Further Reading

AWS IAM Access Analyzer User Guide
AWS IAM Policy Validation Documentation
AWS Security Best Practices
AWS Well-Architected Framework – Security Pillar
AWS IAM Documentation

🚀 Next Lesson

➡️ Lesson 14 — IAM Security Best Practices