AWSOverview
IAM Access Analyzer helps identify unintended external access paths to resources.
What this control should detect
Regions where Access Analyzer is not configured according to organization policy.
Remediation guidance
AWS Remediation
Service-Wide (Recommended)
Enable Access Analyzer as part of account vending and region activation standards.
Console (Asset-Level)
- Open IAM Console and select Access Analyzer.
- Create analyzer in each in-scope region.
- Use account or organization analyzer type as required by policy.
AWS CLI (Asset-Level)
aws accessanalyzer create-analyzer --analyzer-name <analyzer-name> --type ACCOUNT
References
- https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html
Query logic
These are the stored checks tied to this control.
Access analyzers not active
Connectors
AWS
Covered asset types
AccessAnalyzer
Expected check: eq []
{ accessAnalyzers(where: { OR: [ { status_NOT: "ACTIVE" }, { type_NOT_IN: ["ACCOUNT", "ORGANIZATION"] } ] }) { ...AssetFragment } }
