# Ensure IAM Access Analyzer has no active findings - Source: https://support.icompaas.com/support/solutions/articles/a_1793286569016245-ensure-iam-access-analyzer-has-no-active-findings - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every IAM Access Analyzer analyzer with status ACTIVE has no active findings. Access Analyzer reviews resource policies and role trust policies to identify resources, such as S3 buckets, IAM roles, KMS keys and snapshots, that can be accessed from outside the account. Although IAM itself is a global service, IAM Access Analyzer is regional: an analyzer only reviews resources in the region where it is created. Only analyzers with status ACTIVE are evaluated; regions without an active analyzer are not reported by this check, so an analyzer should still be created in each region in use. **Rationale** Without an active analyzer, there is no continuous visibility into resources that are shared publicly or with other accounts. Active findings that are not reviewed indicate access paths that may be unintended, allowing data to be read from outside the account, roles to be assumed by external parties, or attackers to move between accounts. Enabling the analyzer and resolving every active finding ensures that only intended external access remains. **Impact** - Provides continuous visibility into public and cross-account access to resources - Helps detect unintended access before it can be exploited - Resolving findings may require removing permissions that some external users or accounts currently rely on **Default Value** IAM Access Analyzer is not enabled by default. No analyzer exists in any region until one is created. **Pre-Requisites** - IAM permissions: access-analyzer:CreateAnalyzer, access-analyzer:ListAnalyzers, access-analyzer:ListFindings, access-analyzer:UpdateFindings and iam:CreateServiceLinkedRole - Permissions to edit the resource policies or role trust policies named in the findings - Confirmation from resource owners on which external access is intended **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Access analyzer** in the left menu. 3. Choose **Analyzer settings** and check that an analyzer exists with status **Active**. 4. Open the analyzer's findings and check the number of **Active** findings. 5. Repeat for each region in use. 6. If any active analyzer has active findings, follow the implementation steps. **CLI:** List the analyzers in a region: aws accessanalyzer list-analyzers --region --query "analyzers\[\].\[name,status,arn\]" --output table List the active findings of an analyzer: aws accessanalyzer list-findings --region --analyzer-arn --filter '{"status": {"eq": \["ACTIVE"\]}}' --query "findings\[\].\[id,resourceType,resource\]" --output table An analyzer with status ACTIVE fails if the second command returns one or more active findings. Analyzers that are not ACTIVE, and regions without an analyzer, are not evaluated. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Access analyzer** in the left menu. 3. If no analyzer exists, choose **Analyzer settings**, then **Create analyzer**: - select **External access** analysis, - enter a name and set the zone of trust to **Current account** (or **Current organization**), - choose **Create analyzer**. 4. Open the analyzer's findings and review each **Active** finding. 5. For access that is not intended, open the finding, go to the affected resource and remove the permission from its resource policy or trust policy. Then return to the finding and choose **Rescan**. 6. For access that is intended, select the finding and choose **Archive**. 7. Repeat for each region in use. **CLI:** Create an analyzer for the account: aws accessanalyzer create-analyzer --region --analyzer-name --type ACCOUNT Archive a finding after confirming the access is intended: aws accessanalyzer update-findings --region --analyzer-arn --ids --status ARCHIVED **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Access analyzer** in the left menu. 3. To reactivate an archived finding, open the **Archived** findings, select it and choose **Unarchive**. 4. To restore a removed permission, add the original statement back to the resource policy or trust policy. 5. To remove the analyzer, choose **Analyzer settings**, select the analyzer and choose **Delete**. **CLI:** aws accessanalyzer delete-analyzer --region --analyzer-name Note: deleting the analyzer removes visibility into external access. Use it only as a temporary measure. **Reference** - [https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html) - [https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html) - [https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-findings-remediate.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-findings-remediate.html) - [https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/create-analyzer.html](https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/create-analyzer.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.