AWS IAM ACCESS ANALYSIS & REPORTS

📌 This article is part of the AWS IAM Deep Dive series.

1. What is Access Analysis & Reports in IAM?

AWS IAM Access Analysis & Reports are built-in tools that help you monitor, audit, and understand permissions across your AWS environment.

They help you detect unused, excessive, or risky permissions — ensuring you always follow the principle of least privilege.

2. Key Components

Access Analyzer

• Scans resource-based policies to identify public or cross-account access.
• Detects exposure in S3, KMS, IAM roles, and Lambda layers.
• Automatically monitors and flags new findings.

Example: Detect if an S3 bucket policy accidentally allows "Principal": "*"

Resource Analysis (New)

• Extends Access Analyzer to perform deep inspection at the resource level.
• Reveals who can access specific resources and how that access is granted.
• Ideal for pinpointing permission paths and exposure.

Example: Check who can modify an EC2 security group or delete a Lambda function.

Unused Access

• Identifies permissions that have not been used within a set period (usually 90 days).
• Helps you safely remove or restrict policies without affecting workloads.

Example: Remove ec2:DescribeInstances from users who haven’t accessed EC2 in 3 months.

Access Reports

• Generate detailed reports for users, groups, and roles.
• View permissions and service last accessed data for better auditing.

Example: Review if a role still needs access to RDS or Lambda.

🔑 Credential Reports

Generate an account-wide CSV showing:

• Password last used
• Access key age
• MFA status
• Last rotation date

Essential for compliance and governance reviews.

Example: Identify users with no MFA or old access keys.

3. Why It Matters

Access Analysis & Reports help you:

• Detect over-permissioned users and roles.
• Identify publicly exposed resources.
• Enforce compliance (SOC2, ISO, PCI).
• Simplify audits and maintain governance visibility.

4. Hands-On Guide

🎯 Goal: Detect and Fix Over-Permissive Access

Step 1: Enable Access Analyzer

1. Go to IAM → Access Analyzer → Create Analyzer

1. Choose your region

2. Select Organization or Account scope

   

3. Click Create Analyzer

• AWS now continuously scans your environment for risky access.

Step 2: Review Findings

• Go to Findings tab
• Sort by Public access or Cross-account access
• Review each finding → Resolve or Archive

Tip: Use tags or filters to focus on sensitive resources only.

Step 3: Generate a Credential Report

aws iam generate-credential-report  
aws iam get-credential-report --query 'Content' --output text | base64 --decode > credential-report.csv

Review the CSV for:

• Users without MFA
• Expired access keys
• Root account usage

Step 4: Clean Up Unused Access

1. Go to IAM → Users → Access Advisor
2. Remove permissions from inactive or unused services.

• You’ve just completed a mini IAM audit!

5. Best Practices

• Review Access Analyzer findings weekly
• Rotate access keys every 90 days or less
• Delete inactive users and roles immediately
• Grant least privilege only
• Automate credential report checks via Lambda or AWS Config

6. Industry Examples

Enterprise: Uses Access Analyzer org-wide to detect cross-account S3 exposure.

Finance: Monthly credential report audits to maintain PCI compliance.

DevOps: Automated alerts when new public access findings appear.

Startup: Regular cleanup of unused IAM roles post-project delivery.

7. Interview Questions

🟢 Basic

• What is AWS Access Analyzer?
• What’s the difference between Access Analyzer and Access Reports?

🟡 Intermediate

• How do you detect unused IAM permissions?
• What information does a Credential Report contain?

🔴 Advanced

• How can you automate IAM auditing using AWS Config or Lambda?
• How would you secure multi-account Access Analyzer configurations?

🙏 Wrapping Up

Access Analysis & Reports act as your AWS security microscope — revealing what’s open, unused, or unsafe in your IAM setup.

Mastering these tools helps you maintain visibility, control, and compliance across all AWS accounts.

🔑 Key Takeaways

• Use Access Analyzer to detect risky access.
• Generate credential reports regularly.
• Remove unused permissions proactively.
• Enforce least privilege continuously.

Thanks for reading!

If this helped:

❤️ Leave a like and follow for more AWS/DevOps deep dives

💬 Comment your IAM audit tips or questions

🔗 Share with your team to promote better AWS security hygiene

🚀 Hurray you’ve completed the IAM Deep Dive Series