Skip to content
SPECIFICTION
Get listed

AWS IAM Access Analyzer

aws.amazon.com

From $0.20/mo Free plan WebiOSAndroidAPI
Visit aws.amazon.com
Spec score 9.4 #1 of 25 in Cloud Infrastructure Entitlement Management Software

What it is

AWS IAM Access Analyzer helps teams set, verify, and refine permissions toward least privilege. It examines external, internal, and unused access to AWS resources. External analysis monitors for new or changed permissions that allow public or cross-account access; internal findings identify users and roles with access to S3, DynamoDB, or RDS resources. Unused-access findings can identify unused roles, IAM user keys and passwords, services, and actions. The service can generate fine-grained IAM policies from activity captured in AWS CloudTrail logs, and policy validation supplies security warnings, errors, general warnings, and best-practice suggestions. Custom policy checks can be integrated into CI/CD pipelines before deployment. The analyzer also provides last-accessed information for services and actions from select AWS services and connects with AWS Security Hub CSPM and Amazon EventBridge for findings workflows. AWS says automated reasoning technology applies mathematical logic to assess permissions. Policy validation, policy generation, and external access analysis are provided at no additional charge. Other listed charges include $0.0020 per custom policy-check API call, $0.20 per IAM role or user per month for unused-access analysis, and $9.00 per resource monitored per Region per month for internal access analysis.

Spec sheet

What it does
IAM Access Analyzer uses automated reasoning to identify external, internal, and unused access and to create or validate IAM policies.Read 14 Oct 2026 · aws.amazon.com
Purpose
IAM Access Analyzer helps set, verify, and refine permissions on the journey toward least privilege.Read 29 Sep 2026 · aws.amazon.com
Intended users
AWS describes the service as helping security teams review and refine access and compliance teams demonstrate access-control audit requirements.Read 29 Sep 2026 · aws.amazon.com
Integrations
It integrates with AWS Security Hub CSPM and Amazon EventBridge for findings analysis and notification workflows.Read 29 Sep 2026 · aws.amazon.com
Access findings
It analyzes external, internal, and unused access to AWS resources.Read 29 Sep 2026 · aws.amazon.com
Access previews
The service can preview public and cross-account access before policy changes are deployed.Read 14 Oct 2026 · docs.aws.amazon.com
API availability
The AWS CLI exposes accessanalyzer commands for analyzers, findings, policy checks, previews, and policy generation.Read 14 Oct 2026 · docs.aws.amazon.com
Automated reasoning engine
AWS documentation says the service uses Zelkova to translate policies into logical statements and solve authorization properties.Read 14 Oct 2026 · docs.aws.amazon.com
Custom policy checks
Custom checks compare proposed policies with customer security standards and can test for newly granted or forbidden access.Read 14 Oct 2026 · docs.aws.amazon.com
Development workflow
Custom policy checks can be integrated into CI/CD pipelines to review policies before deployment.Read 29 Sep 2026 · aws.amazon.com
Documentation depth
AWS publishes a user guide, CLI command reference, API reference, quotas, integration guides, policy-check references, and SDK documentation.Read 14 Oct 2026 · aws.amazon.com
EventBridge integration
Access Analyzer emits EventBridge events when findings are created, changed, or deleted, enabling automated targets and workflows.Read 14 Oct 2026 · docs.aws.amazon.com
External access findings
External analyzers detect resource policies that allow public or cross-account access outside a configured zone of trust.Read 14 Oct 2026 · docs.aws.amazon.com
External monitoring
The external access analyzer continuously monitors for new or updated resource permissions that grant public or cross-account access.Read 29 Sep 2026 · aws.amazon.com
Independent usage limitation
A Reddit discussion notes that policy-generation quality depends on which CloudTrail data events and services have been logged.Read 14 Oct 2026 · reddit.com
Internal access findings
Internal analyzers show which principals in an account or organization can reach selected resources and the effective access paths.Read 14 Oct 2026 · docs.aws.amazon.com
Internal resource coverage
Internal access findings identify users and roles with access to S3, DynamoDB, or RDS resources.Read 29 Sep 2026 · aws.amazon.com
Internal resource scope
Internal analysis currently supports S3 buckets, RDS DB and cluster snapshots, S3 Express directory buckets, DynamoDB tables and DynamoDB streams.Read 14 Oct 2026 · docs.aws.amazon.com
JavaScript SDK
The npm package @aws-sdk/client-accessanalyzer supplies generated JavaScript and TypeScript client commands for the service.Read 14 Oct 2026 · npmjs.com
Last accessed data
The service provides last accessed information for AWS services and actions from select AWS services.Read 29 Sep 2026 · aws.amazon.com
Limit: analysis delays
Policy changes normally take up to about 30 minutes to update external findings, while some changes wait for periodic scans up to 24 hours.Read 14 Oct 2026 · docs.aws.amazon.com
Limit: detection without remediation
A practitioner discussion criticizes Access Analyzer as primarily flagging over-permissioned roles or stale keys while leaving remediation to operators.Read 14 Oct 2026 · reddit.com
Limit: external-account visibility
The analyzer does not know the users, roles, SCPs, or other configurations inside an external AWS account it reports.Read 14 Oct 2026 · docs.aws.amazon.com
Limit: false positives
When access cannot be fully determined, AWS says the analyzer may err toward a false-positive finding to reduce false negatives.Read 14 Oct 2026 · docs.aws.amazon.com
Limit: findings overload
MatrixGard reports that teams may enable the service, receive a large wall of findings, and then stop triaging them.Read 14 Oct 2026 · matrixgard.com
Limit: internal scale
Internal findings are unavailable for organizations containing more than 70,000 IAM users and roles combined.Read 14 Oct 2026 · docs.aws.amazon.com
Limit: policy activity is not observed
External analysis does not inspect logs to determine whether an external principal actually used the permitted resource.Read 14 Oct 2026 · docs.aws.amazon.com
Limit: principal threshold
Internal analysis can emit PRINCIPAL_LIMIT_EXCEEDED when more than 3,000 principals reach a critical resource.Read 14 Oct 2026 · docs.aws.amazon.com
Maker founded
LinkedIn states that Amazon Web Services launched in 2006.Read 14 Oct 2026 · linkedin.com
Maker headquarters
LinkedIn lists Seattle, Washington as Amazon Web Services headquarters.Read 14 Oct 2026 · linkedin.com
Maker size
LinkedIn lists Amazon Web Services as having 10,001 or more employees.Read 14 Oct 2026 · linkedin.com
News: organization access analysis
On June 17, 2025, AWS announced that Access Analyzer could identify organizational principals accessing selected S3, DynamoDB, and RDS resources.Read 14 Oct 2026 · aws.amazon.com
News: public and critical-resource checks
On June 11, 2024, AWS announced custom checks for detecting policy updates that grant public access or access to critical resources.Read 14 Oct 2026 · aws.amazon.com
Policy generation
Policy generation creates fine-grained IAM policies from access activity recorded in CloudTrail logs.Read 14 Oct 2026 · docs.aws.amazon.com
Policy validation
Basic validation checks IAM policy grammar and AWS best practices and returns errors, warnings, and suggestions.Read 14 Oct 2026 · docs.aws.amazon.com
Praise: automated reasoning
An independent technical deep dive praises Access Analyzer for replacing manual policy reasoning with automated proofs across external, internal, and unused access questions.Read 14 Oct 2026 · hidekazu-konishi.com
Praise: low-friction external scanning
MatrixGard describes external analysis as free to enable and able to produce useful findings quickly in small AWS accounts.Read 14 Oct 2026 · matrixgard.com
Python SDK
Boto3 provides an AccessAnalyzer client with operations such as get_analyzer and typed analyzer configurations.Read 14 Oct 2026 · docs.aws.amazon.com
SDK licence
The JavaScript Access Analyzer SDK package is distributed under the Apache License 2.0.Read 14 Oct 2026 · npmjs.com
Security Hub integration
Findings can flow into AWS Security Hub CSPM using the AWS Security Finding Format for centralized security analysis.Read 14 Oct 2026 · docs.aws.amazon.com
Security method
The service uses automated reasoning technology, applying mathematical logic to assess AWS permissions.Read 29 Sep 2026 · aws.amazon.com
Self-hosting
Access Analyzer is presented as an AWS managed service configured in the IAM console and accessed through AWS APIs rather than as a self-hosted download.Read 14 Oct 2026 · aws.amazon.com
Supported external resources
External analysis covers resources including S3 buckets, IAM roles, KMS keys, Lambda, SQS, Secrets Manager, SNS, EBS snapshots, RDS snapshots, ECR, EFS, DynamoDB tables and streams.Read 14 Oct 2026 · docs.aws.amazon.com
Unused access
Unused access findings can identify unused roles, IAM user access keys, IAM user passwords, services, and actions.Read 29 Sep 2026 · aws.amazon.com
Unused access findings
Unused analyzers identify inactive roles, unused access keys and passwords, and unused service or action permissions.Read 14 Oct 2026 · docs.aws.amazon.com

Plans and prices

Custom policy checks Free per API check checks run through IAM Access Analyzer APIs · policy standards and access checks Read 14 Oct 2026 · aws.amazon.com
External access analysis Free no additional charge public and cross-account findings · supported AWS resources · regional analyzers Read 14 Oct 2026 · aws.amazon.com
External access analyzer Free Provided at no additional charge Public and cross-account access findings for AWS resources Read 29 Sep 2026 · aws.amazon.com
IAM policy validation Free Provided at no additional charge Validates policies against IAM best practices Read 29 Sep 2026 · aws.amazon.com
Policy generation Free Provided at no additional charge Generates fine-grained policies based on access activity captured in logs Read 29 Sep 2026 · aws.amazon.com
Unused access analysis $0.20 a month per IAM role or user analyzed per month IAM roles and users · one analyzer across Regions in a partition Read 14 Oct 2026 · aws.amazon.com
Unused access analyzer $0.20 a month $0.20 per IAM role or IAM user per month One analyzer across all Regions in a partition because IAM roles and users are global Read 29 Sep 2026 · aws.amazon.com
Internal access analysis $9 a month per monitored resource per Region per month selected business-critical resources · AWS Organizations or account scope Read 14 Oct 2026 · aws.amazon.com
Internal access analyzer $9 a month $9.00 per resource monitored per Region per month Monitors access to business-critical AWS resources within an AWS organization Read 29 Sep 2026 · aws.amazon.com

Every AWS IAM Access Analyzer plan and price →

Strong points and limits

Strong points

  • Analyzes external, internal, and unused access
  • Generates IAM policies from CloudTrail activity
  • Policy validation provides warnings and best-practice suggestions
  • Custom checks can run in CI/CD pipelines
  • Policy validation, generation, and external analysis cost nothing extra

Limits

  • Custom checks cost $0.0020 per API call
  • Unused-access analysis costs $0.20 per role or user monthly
  • Internal analysis costs $9.00 per resource per Region monthly

Who it suits

The analyzer suits AWS security teams reviewing permissions and compliance teams demonstrating access-control audit requirements. It also fits development teams that want policy checks in CI/CD pipelines.

AWS IAM Access Analyzer in depth

Read the full write-up

Overview

AWS IAM Access Analyzer is an AWS permissions analysis service for teams working to reduce access to least privilege. It suits security teams reviewing AWS access and compliance teams demonstrating access-control requirements. Its broad set of AWS-focused checks and policy tools are useful, though some analysis incurs usage-based charges.

Key features

Findings across resource access

The service continuously checks for new or changed resource permissions that expose AWS resources publicly or across accounts. Internal findings identify users and roles with access to S3, DynamoDB, or RDS; unused-access findings can surface dormant roles, IAM user keys or passwords, services, and actions. Last-accessed data for services and actions from select AWS services adds context to review decisions.

This range helps teams investigate both exposure and stale permissions, but internal analysis is limited to the named resource types. Internal and unused analysis also have separate usage charges, so organizations should consider the monitored resources and identities before enabling them broadly.

Policy work and integrations

Access activity captured in CloudTrail logs can be turned into fine-grained IAM policies. Validation checks policies for security warnings, errors, general warnings, and best-practice suggestions. Custom policy checks can run in CI/CD pipelines before deployment, while Security Hub CSPM and EventBridge support findings analysis and notification workflows.

Automated reasoning applies mathematical logic to assess AWS permissions. That gives the service a formal basis for evaluating permissions, but it remains centered on AWS policy and resource access rather than general-purpose identity management.

Pricing

The core capabilities have no additional charge: IAM policy validation, policy generation, and external access analysis are each free. That makes policy review and public or cross-account exposure monitoring a straightforward fit for AWS teams seeking a no-charge starting point.

Custom policy checks are free, billed at $0.0020 per API call. This suits teams that need pipeline checks, but costs rise with each check run. The unused access analyzer is $0.20 a month, billed at $0.20 per IAM role or IAM user per month; one analyzer covers all Regions in a partition because roles and users are global. The internal access analyzer is $9 a month, billed at $9.00 per resource monitored per Region per month, for teams monitoring business-critical resources within an AWS organization. These charges make targeted use more compelling than indiscriminate monitoring.

Platforms

Access Analyzer is a SaaS service for AWS, with web and API platforms plus Android and iOS listed. Policy simulation is supported. Identity-related capabilities include SAML 2.0, OAuth 2.0, and OIDC, FIDO2 authenticators, virtual authenticator apps, and RADIUS MFA, as well as directory sync and lifecycle provisioning. Adaptive access and adaptive access policies are not supported.

Who it's for

Choose Access Analyzer if your organization operates AWS resources and needs to review exposure, stale access, or policy quality. Its findings and policy generation are particularly relevant to security teams refining permissions; compliance teams can use it to demonstrate access-control audit requirements. It is less suitable as a standalone choice for organizations seeking broad identity management or adaptive access controls.

Pros and cons

Pros: External access analysis, policy validation, and policy generation carry no additional charge, giving AWS teams several useful permission controls without a per-resource fee.

Pros: Findings cover external, selected internal, and unused access, while integrations can route findings into existing analysis and notification workflows.

Cons: Internal analysis is limited to S3, DynamoDB, and RDS resources, and costs $9.00 per resource monitored per Region per month.

Cons: Custom checks and unused-access analysis add usage-based costs, and adaptive access is not supported.

Alternatives

For broader cloud-security options, consider these alternatives:

CrowdStrike Falcon Surface may suit readers seeking a paid product with a free trial and Linux, macOS, web, and Windows platforms; its Falcon Exposure Management plan requires scheduling a demo.

C3M Cloud Control offers a free cloud security assessment for up to 2 cloud accounts and a free trial, making it worth considering for a small initial assessment.

Qualys TotalCloud has a free license with limited API calls for control evaluation and a free trial, which may fit a limited evaluation before a paid subscription.

Rapid7 Surface Command is another paid option with a free trial and API, desktop, and web platforms.

SentinelOne Singularity Cloud Security is a paid option for readers who want Android, iOS, web, and API platforms; its listed plans are billed per endpoint.

Sysdig Secure bases licensing on the number of hosts in a customer's environment, including compute instances for CSPM.

FortiCNAPP offers Standard plans with one- or three-year terms and entitlement per vCPU.

Palo Alto Networks Cortex Cloud API Security is another alternative.

Readers comparing broader categories can also browse Cloud Infrastructure Entitlement Management Software, Identity and Access Management Software, and Single Sign-On Software.

Verdict

AWS IAM Access Analyzer is a strong fit for AWS organizations that want to inspect permissions and improve policies, especially when external findings and validation are the priorities. Choose it for its AWS-specific access coverage and no-additional-charge policy tools; look elsewhere if you need adaptive access, broader identity management, or cannot accommodate usage-based charges for deeper analysis.

Verdict

IAM Access Analyzer covers several kinds of access review and policy work for AWS resources, with policy validation, generation, and external analysis at no additional charge. Custom checks and unused or internal access analysis carry listed usage-based charges.

Where Specifiction places it

Alternatives to AWS IAM Access AnalyzerAll alternatives →