AWS IAM ACCESS ANALYSIS & REPORTS Deep Dive

aws #iam #security #devops

📌 This article is part of the AWS IAM Deep Dive series.

• 
  Part 1: IAM Users Deep Dive
  


• 
  Part 2: IAM Groups Deep Dive
  


• 
  Part 3: IAM Roles Deep Dive
  


• 
  Part 4: IAM Policies Deep Dive
  


• Part 5: IAM Identity Providers Deep Dive


• Part 6: AWS IAM ACCOUNT & ROOT MANAGEMENT Deep Dive


• 
  Part 7: AWS IAM Access Analysis & Reports Deep Dive (You’re here!)
  

1. What is Access Analysis & Reports in IAM?

AWS IAM Access Analysis & Reports are built-in tools that help you monitor, audit, and understand permissions across your AWS environment.


They help you detect unused, excessive, or risky permissions — ensuring you always follow the principle of least privilege.

2. Key Components

Access Analyzer

• Scans resource-based policies to identify public or cross-account access.
  


• Detects exposure in S3, KMS, IAM roles, and Lambda layers.
  


• Automatically monitors and flags new findings.
  

Example: Detect if an S3 bucket policy accidentally allows "Principal": "*"

Resource Analysis (New)

• Extends Access Analyzer to perform deep inspection at the resource level.
  


• Reveals who can access specific resources and how that access is granted.
  


• Ideal for pinpointing permission paths and exposure.
  

Example: Check who can modify an EC2 security group or delete a Lambda function.

Unused Access

• Identifies permissions that have not been used within a set period (usually 90 days).
  


• Helps you safely remove or restrict policies without affecting workloads.
  

Example: Remove ec2:DescribeInstances from users who haven’t accessed EC2 in 3 months.

Access Reports

• Generate detailed reports for users, groups, and roles.
  


• View permissions and service last accessed data for better auditing.
  

Example: Review if a role still needs access to RDS or Lambda.

🔑 Credential Reports

Generate an account-wide CSV showing:

• Password last used
  


• Access key age
  


• MFA status
  


• Last rotation date
  

Essential for compliance and governance reviews.

Example: Identify users with no MFA or old access keys.

3. Why It Matters

Access Analysis & Reports help you:

• Detect over-permissioned users and roles.
  


• Identify publicly exposed resources.
  


• Enforce compliance (SOC2, ISO, PCI).
  


• Simplify audits and maintain governance visibility.
  

4. Hands-On Guide

🎯 Goal: Detect and Fix Over-Permissive Access

Step 1: Enable Access Analyzer

1. Go to IAM → Access Analyzer → Create Analyzer

1. Choose your region
   



2. Select Organization or Account scope
   
   
   




3. Click Create Analyzer

• AWS now continuously scans your environment for risky access.
  

Step 2: Review Findings

• Go to Findings tab
  


• Sort by Public access or Cross-account access
  


• Review each finding → Resolve or Archive
  

Tip: Use tags or filters to focus on sensitive resources only.

Step 3: Generate a Credential Report

aws iam generate-credential-report  

aws iam get-credential-report --query 'Content' --output text | base64 --decode > credential-report.csv

Review the CSV for:

• Users without MFA
  


• Expired access keys
  


• Root account usage
  

Step 4: Clean Up Unused Access

1. Go to IAM → Users → Access Advisor
   


2. Remove permissions from inactive or unused services.
   

• You’ve just completed a mini IAM audit!
  

5. Best Practices

• Review Access Analyzer findings weekly
  


• Rotate access keys every 90 days or less
  


• Delete inactive users and roles immediately
  


• Grant least privilege only
  


• Automate credential report checks via Lambda or AWS Config
  

6. Industry Examples

Enterprise: Uses Access Analyzer org-wide to detect cross-account S3 exposure.


Finance: Monthly credential report audits to maintain PCI compliance.


DevOps: Automated alerts when new public access findings appear.


Startup: Regular cleanup of unused IAM roles post-project delivery.

7. Interview Questions

🟢 Basic

• What is AWS Access Analyzer?
  


• What’s the difference between Access Analyzer and Access Reports?
  

🟡 Intermediate

• How do you detect unused IAM permissions?
  


• What information does a Credential Report contain?
  

🔴 Advanced

• How can you automate IAM auditing using AWS Config or Lambda?
  


• How would you secure multi-account Access Analyzer configurations?
  

🙏 Wrapping Up

Access Analysis & Reports act as your AWS security microscope — revealing what’s open, unused, or unsafe in your IAM setup.


Mastering these tools helps you maintain visibility, control, and compliance across all AWS accounts.

🔑 Key Takeaways

• Use Access Analyzer to detect risky access.
  


• Generate credential reports regularly.
  


• Remove unused permissions proactively.
  


• Enforce least privilege continuously.
  

Thanks for reading!


If this helped:


❤️ Leave a like and follow for more AWS/DevOps deep dives


💬 Comment your IAM audit tips or questions


🔗 Share with your team to promote better AWS security hygiene

🚀 Hurray you've completed the IAM Deep Dive Series