AWS IAM Access Analyzer vs Sonrai Cloud Permissions Firewall

AWS IAM Access Analyzer helps teams set, verify, and refine permissions toward least privilege. It examines external, internal, and unused access to AWS resources. External analysis monitors for new or changed permissions that allow public or cross-account access; internal findings identify users and roles with access to S3, DynamoDB, or RDS resources. Unused-access findings can identify unused roles, IAM user keys and passwords, services, and actions. The service can generate fine-grained IAM policies from activity captured in AWS CloudTrail logs, and policy validation supplies security warnings, errors, general warnings, and best-practice suggestions. Custom policy checks can be integrated into CI/CD pipelines before deployment. The analyzer also provides last-accessed information for services and actions from select AWS services and connects with AWS Security Hub CSPM and Amazon EventBridge for findings workflows. AWS says automated reasoning technology applies mathematical logic to assess permissions. Policy validation, policy generation, and external access analysis are provided at no additional charge. Other listed charges include $0.0020 per custom policy-check API call, $0.20 per IAM role or user per month for unused-access analysis, and $9.00 per resource monitored per Region per month for internal access analysis.

Sonrai Cloud Permissions Firewall monitors privileged permissions for identities across AWS, Azure and GCP. It covers human users, service principals, agents and managed identities, removing sensitive permissions that are no longer used, quarantining inactive role assignments and enforcing default deny. Permissions on Demand routes restricted-access requests through approval in ChatOps and updates the policy afterward. The web service uses read-only, top-level cloud access to collect metadata and does not install cloud agents. Onboarding occurs at the AWS, Azure or GCP organisation level, bringing in every account, subscription or project; controls can then be applied selectively. Sonrai describes unified enforcement and one audit trail across the three clouds. Available options include integrations with Slack, Teams and email, enterprise SSO, just-in-time access, third-party access lockdown, identity quarantine and other remediation controls. Support is provided by email, phone and chat. A 14-day trial requires a business email. Plans list $150 a month for 10–50 accounts and $15,000 a year for startup pricing; 50+ accounts use custom pricing.