c1.7 Clean up unintended and unused access
Use IAM Access Analyzer to find resources shared outside your organization, unused roles, keys, and permissions, and then remediate them to shrink the blast radius of any compromise.
Implementation guidance
Find external access (free)
IAM Access Analyzer continuously reviews resource policies and reports what is shared outside your account or organization — a public S3 bucket, a role trusting an external account, and so on. The external access analyzer is provided at no additional charge; enable it for the whole organization and investigate every finding.
Find unused and internal access
Access Analyzer also offers unused access analysis (a paid feature) that flags unused IAM roles, unused access keys, unused passwords, and, for active principals, unused services and actions — the raw material for moving toward least privilege. An internal access analyzer shows who inside your organization can reach critical resources. All three views (external, unused, internal) roll up into a single findings dashboard.
Act on the findings
Detection only helps if you remediate: remove unused roles, keys, and permissions to reduce the blast radius, and tighten or remove unintended external sharing. Assign an owner to work the findings continuously, not once.
Alternatives
Cloud Infrastructure Entitlement Management (CIEM) tools — often part of a CNAPP — provide similar entitlement clean-up across clouds (for example Wiz, Palo Alto Prisma Cloud, and Tenable).
Enable it with the CLI
Create an organization-wide external-access analyzer (free), then list its active findings:
aws accessanalyzer create-analyzer \
--analyzer-name org-external-access \
--type ORGANIZATION
aws accessanalyzer list-findings \
--analyzer-arn <analyzer-arn> \
--filter '{"status":{"eq":["ACTIVE"]}}'How to validate
- Have you enabled an external access analyzer for the whole organization?
- Are you using the unused access analyzer to find unused roles, keys, and permissions?
- Is someone investigating and remediating the findings continuously?
- Do you also use a CIEM/CNAPP, and which of its capabilities are actually in use?
Threats addressed
- ATT&CK Credential Access unused roles and keys are extra credentials an attacker can steal; removing them shrinks the blast radius.
- ATT&CK Persistence: Create Account an attacker who gets in may create durable credentials to persist; unused-access findings help surface them.
AWS services
IAM Access Analyzer AWS IAM Pricing
IAM Access Analyzer's external access analyzer is free. The internal access analyzer is billed per resource monitored per Region per month, and the unused access analyzer per IAM role or user per month. See IAM Access Analyzer pricing.