Lesson 03 — IAM Access Analyzer & Amazon Macie

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 09 – Vulnerability & Compliance Management

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand IAM Access Analyzer.
Identify unintended public and cross-account access.
Review IAM permissions using least privilege principles.
Discover sensitive data using Amazon Macie.
Protect confidential information stored in Amazon S3.
Build an enterprise data security strategy.
Design continuous access review processes.

📚 Lesson Information

Estimated Time: 3.5 Hours

Difficulty: Intermediate

Prerequisites: Lesson 02 – Amazon Inspector & Patch Management

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies stores millions of customer records within Amazon S3.

The company also operates:

45 AWS Accounts
Thousands of IAM Roles
Hundreds of Third-Party Integrations
Production APIs
Data Analytics Platform
AI Training Platform

During an internal audit, the security team discovers several concerning findings.

Examples include:

Public S3 buckets
IAM roles with AdministratorAccess
Cross-account access from unknown AWS accounts
Customer data stored without proper classification
Sensitive documents shared unintentionally
Personally Identifiable Information (PII) stored in multiple locations

The CISO asks:

“How can we continuously identify excessive permissions and sensitive data before they become security incidents?”

As the Cloud Security Engineer, your task is to implement continuous access analysis and sensitive data discovery across the AWS environment.

Why Identity & Data Security Matter

Modern attacks rarely begin with malware.

Instead, attackers often exploit:

Excessive IAM permissions
Public resources
Misconfigured bucket policies
Shared credentials
Exposed confidential information

Protecting identities and sensitive data is just as important as protecting infrastructure.

Enterprise Security Strategy

CloudNova follows a layered approach.

Identity

↓

Permissions

↓

Data

↓

Monitoring

↓

Compliance

↓

Continuous Improvement

What is IAM Access Analyzer?

IAM Access Analyzer continuously evaluates resource policies and identifies unintended access.

It analyses resources such as:

Amazon S3 Buckets
IAM Roles
AWS KMS Keys
Amazon SQS Queues
AWS Secrets Manager
Amazon ECR Repositories

The service automatically detects when resources can be accessed from outside the organisation.

How IAM Access Analyzer Works

AWS Resource

↓

Resource Policy

↓

Policy Analysis

↓

External Access?

↓

Finding Generated

↓

Security Review

Types of Findings

IAM Access Analyzer identifies:

Public Access
Cross-Account Access
External Principal Access
Unused Permissions
Overly Broad Policies

These findings help security teams enforce least privilege.

Example Finding

Property	Example
Resource	Amazon S3 Bucket
Finding	Public Access
Severity	High
Principal	Everyone (*)
Recommendation	Remove Public Policy

Public Access Example

{
  "Principal": "*",
  "Effect": "Allow",
  "Action": "s3:GetObject"
}

This policy allows anyone on the Internet to access objects inside the bucket.

IAM Access Analyzer flags this configuration.

Cross-Account Access

Example:

Production Account

↓

IAM Role

↓

Trusted External AWS Account

↓

Finding Generated

Not all cross-account access is bad.

The objective is to verify that every external trust relationship is intentional.

Least Privilege Principle

CloudNova follows one rule:

Grant only the permissions required to perform the task.

Example:

Instead of:

AdministratorAccess

Use:

AmazonS3ReadOnlyAccess

Custom Least Privilege Policy

Smaller permissions reduce the attack surface.

IAM Permission Review Process

IAM Roles

↓

Access Analyzer

↓

Unused Permissions

↓

Policy Review

↓

Least Privilege

↓

Deploy Updated Policy

Continuous review helps prevent privilege creep.

What is Amazon Macie?

Amazon Macie is a fully managed data security service.

It automatically discovers and classifies sensitive information stored in Amazon S3.

Macie identifies:

Personally Identifiable Information (PII)
Financial Data
Credentials
Health Information
Intellectual Property
Business Documents

How Amazon Macie Works

Amazon S3

↓

Object Scan

↓

Content Inspection

↓

Sensitive Data Discovery

↓

Classification

↓

Security Findings

Macie examines object contents—not just bucket names or metadata.

Sensitive Data Types

Macie can identify information such as:

Passport Numbers
Credit Card Numbers
Aadhaar Numbers
PAN Numbers
Bank Account Numbers
Email Addresses
Phone Numbers
Medical Records
API Keys
Access Tokens

Data Classification

CloudNova classifies information into four categories.

Classification	Examples
Public	Marketing Material
Internal	Employee Documentation
Confidential	Customer Information
Highly Confidential	Financial Records, Encryption Keys

Security controls become stricter as sensitivity increases.

Sample Macie Finding

Property	Example
Bucket	customer-records-prod
Object	customers.csv
Finding	Credit Card Numbers Detected
Severity	High
Recommendation	Restrict Access & Encrypt

Enterprise Data Protection Workflow

Amazon S3

↓

Amazon Macie

↓

Sensitive Data Detection

↓

Security Hub

↓

SOC Investigation

↓

Remediation

IAM Access Analyzer + Amazon Macie

Together they provide complete visibility.

IAM Access Analyzer

↓

Who Can Access Data?

+

Amazon Macie

↓

What Sensitive Data Exists?

↓

Enterprise Risk Assessment

One protects access.

The other protects the data itself.

Enterprise Architecture

                   AWS Organizations
                          │
        ┌─────────────────┼─────────────────┐
        │                 │                 │
 Amazon S3          IAM Policies       Resource Policies
        │                 │                 │
   Amazon Macie    IAM Access Analyzer
        │                 │
        └────────────┬────┘
                     │
              Security Hub
                     │
               CloudWatch
                     │
               SOC Dashboard
                     │
              Security Team

Enterprise Best Practices

CloudNova standards include:

Enable IAM Access Analyzer organisation-wide.
Review external access findings weekly.
Remove unused IAM permissions.
Follow least privilege principles.
Enable Amazon Macie for sensitive buckets.
Encrypt confidential information.
Enable S3 Block Public Access.
Review data classification regularly.
Integrate findings with Security Hub.

🛠 Lab 01 — Enable IAM Access Analyzer

Navigate to:

AWS Console

↓

IAM

↓

Access Analyzer

↓

Create Analyzer

Select:

Organization Analyzer

Review generated findings.

🛠 Lab 02 — Review External Access

Review findings for:

Public Buckets
Cross-Account Access
External Principals
KMS Keys
IAM Roles

Document whether each finding is expected or requires remediation.

🛠 Lab 03 — Review IAM Permissions

Identify an IAM role with excessive permissions.

Replace:

AdministratorAccess

with a least-privilege custom policy.

Test application functionality after the change.

🛠 Lab 04 — Enable Amazon Macie

Navigate to:

AWS Console

↓

Amazon Macie

↓

Enable

Verify:

S3 Inventory
Bucket Discovery
Sensitive Data Discovery

🛠 Lab 05 — Create a Sensitive Data Discovery Job

Configure a discovery job.

Select:

Target Bucket
Scope
Schedule

Review:

Findings
Classification Results
Sensitive Data Types

🛠 Lab 06 — Enterprise Data Review

Review findings.

Identify:

Public Buckets
Sensitive Data
Missing Encryption
Broad IAM Policies

Create an enterprise remediation plan.

💻 AWS CLI Lab

List Access Analyzers

aws accessanalyzer list-analyzers

List Findings

aws accessanalyzer list-findings \
    --analyzer-name CloudNovaAnalyzer

List IAM Roles

aws iam list-roles

List S3 Buckets

aws s3 ls

List Macie Classification Jobs

aws macie2 list-classification-jobs

List Macie Findings

aws macie2 list-findings

✅ Verification

Verify that you can:

✔ Explain IAM Access Analyzer.

✔ Identify public and cross-account access.

✔ Apply least privilege principles.

✔ Explain Amazon Macie.

✔ Discover sensitive information in Amazon S3.

✔ Explain enterprise data classification.

✔ Build enterprise identity and data protection workflows.

🔍 Troubleshooting

Problem

No IAM Access Analyzer findings appear.

Verify:

Analyzer is enabled.
Resource policies exist.
Resources are supported.
Organization integration is configured.

Problem

Amazon Macie finds no sensitive data.

Check:

Bucket selection.
Discovery job status.
IAM permissions.
Object formats.
Supported Regions.

Problem

Application fails after reducing permissions.

Review:

IAM policy simulator.
CloudTrail logs.
Access denied errors.
Least-privilege policy configuration.

🚫 Common Mistakes

❌ Granting AdministratorAccess to every developer.

❌ Ignoring Access Analyzer findings.

❌ Leaving S3 buckets publicly accessible.

❌ Storing sensitive data without encryption.

❌ Never reviewing IAM permissions.

❌ Assuming all cross-account access is malicious.

🧪 DIY Challenge

CloudNova is preparing for a compliance audit involving customer financial records.

Design a solution that:

Detects publicly accessible resources.
Reviews IAM permissions across all AWS accounts.
Discovers sensitive customer information.
Applies least privilege.
Encrypts confidential data.
Generates executive compliance reports.

Prepare:

Identity Review Process
Data Classification Matrix
Access Review Checklist
Sensitive Data Dashboard
Remediation Plan

📊 Knowledge Check

What is IAM Access Analyzer?
What types of findings does Access Analyzer generate?
Why is least privilege important?
What is Amazon Macie?
Which AWS service discovers sensitive data inside Amazon S3?
Why should organisations classify data?
What is the difference between identity security and data security?
How do IAM Access Analyzer and Amazon Macie complement each other?
Why should S3 Block Public Access be enabled?
How do these services improve enterprise compliance?

💡 Key Takeaways

After completing this lesson, you should understand:

IAM Access Analyzer helps organisations identify unintended public and cross-account access to AWS resources.
Applying the principle of least privilege significantly reduces the risk of privilege misuse and lateral movement.
Amazon Macie automatically discovers and classifies sensitive information stored in Amazon S3, helping organisations protect confidential data.
Combining identity analysis with data discovery provides a comprehensive view of access risks and data exposure.
Enterprise organisations should continuously review permissions, classify sensitive data and integrate findings into Security Hub for centralised visibility and remediation.

🚀 Next Lesson

➡️ Lesson 04 — AWS Config, Security Hub & Compliance Management