DEV Community

Cover image for AWS IAM ACCESS ANALYSIS & REPORTS
Ntseze-Nelvis
Ntseze-Nelvis

Posted on

AWS IAM ACCESS ANALYSIS & REPORTS

#aws #iam #security #devops

AWS IAM ACCESS ANALYSIS & REPORTS Deep Dive

aws #iam #security #devops

📌 This article is part of the AWS IAM Deep Dive series.

1. What is Access Analysis & Reports in IAM?

AWS IAM Access Analysis & Reports are built-in tools that help you monitor, audit, and understand permissions across your AWS environment.

They help you detect unused, excessive, or risky permissions — ensuring you always follow the principle of least privilege.

2. Key Components

Access Analyzer

  • Scans resource-based policies to identify public or cross-account access.
  • Detects exposure in S3, KMS, IAM roles, and Lambda layers.
  • Automatically monitors and flags new findings.

Example: Detect if an S3 bucket policy accidentally allows "Principal": "*"

Resource Analysis (New)

  • Extends Access Analyzer to perform deep inspection at the resource level.
  • Reveals who can access specific resources and how that access is granted.
  • Ideal for pinpointing permission paths and exposure.

Example: Check who can modify an EC2 security group or delete a Lambda function.

Unused Access

  • Identifies permissions that have not been used within a set period (usually 90 days).
  • Helps you safely remove or restrict policies without affecting workloads.

Example: Remove ec2:DescribeInstances from users who haven’t accessed EC2 in 3 months.

Access Reports

  • Generate detailed reports for users, groups, and roles.
  • View permissions and service last accessed data for better auditing.

Example: Review if a role still needs access to RDS or Lambda.

🔑 Credential Reports

Generate an account-wide CSV showing:

  • Password last used
  • Access key age
  • MFA status
  • Last rotation date

Essential for compliance and governance reviews.

Example: Identify users with no MFA or old access keys.

3. Why It Matters

Access Analysis & Reports help you:

  • Detect over-permissioned users and roles.
  • Identify publicly exposed resources.
  • Enforce compliance (SOC2, ISO, PCI).
  • Simplify audits and maintain governance visibility.

4. Hands-On Guide

🎯 Goal: Detect and Fix Over-Permissive Access

Step 1: Enable Access Analyzer

  1. Go to IAM → Access Analyzer → Create Analyzer

Access Analyzer

  1. Choose your region

  2. Select Organization or Account scope

    IAccount scope

  3. Click Create Analyzer

Create Analyzer

  • AWS now continuously scans your environment for risky access.

Step 2: Review Findings

  • Go to Findings tab
  • Sort by Public access or Cross-account access
  • Review each finding → Resolve or Archive

Tip: Use tags or filters to focus on sensitive resources only.

Step 3: Generate a Credential Report 

aws iam generate-credential-report  
aws iam get-credential-report --query 'Content' --output text | base64 --decode > credential-report.csv
Enter fullscreen mode Exit fullscreen mode

Review the CSV for:

  • Users without MFA
  • Expired access keys
  • Root account usage

Step 4: Clean Up Unused Access

  1. Go to IAM → Users → Access Advisor
  2. Remove permissions from inactive or unused services.
  • You’ve just completed a mini IAM audit!

5. Best Practices

  • Review Access Analyzer findings weekly
  • Rotate access keys every 90 days or less
  • Delete inactive users and roles immediately
  • Grant least privilege only
  • Automate credential report checks via Lambda or AWS Config

6. Industry Examples

Enterprise: Uses Access Analyzer org-wide to detect cross-account S3 exposure.

Finance: Monthly credential report audits to maintain PCI compliance.

DevOps: Automated alerts when new public access findings appear.

Startup: Regular cleanup of unused IAM roles post-project delivery.

7. Interview Questions

🟢 Basic

  • What is AWS Access Analyzer?
  • What’s the difference between Access Analyzer and Access Reports?

🟡 Intermediate

  • How do you detect unused IAM permissions?
  • What information does a Credential Report contain?

🔴 Advanced

  • How can you automate IAM auditing using AWS Config or Lambda?
  • How would you secure multi-account Access Analyzer configurations?

🙏 Wrapping Up

Access Analysis & Reports act as your AWS security microscope — revealing what’s open, unused, or unsafe in your IAM setup.

Mastering these tools helps you maintain visibility, control, and compliance across all AWS accounts.

🔑 Key Takeaways

  • Use Access Analyzer to detect risky access.
  • Generate credential reports regularly.
  • Remove unused permissions proactively.
  • Enforce least privilege continuously.

Thanks for reading!

If this helped:

❤️ Leave a like and follow for more AWS/DevOps deep dives

💬 Comment your IAM audit tips or questions

🔗 Share with your team to promote better AWS security hygiene

🚀 Hurray you've completed the IAM Deep Dive Series

Top comments (0)