Description

Ensure that every IAM Access Analyzer analyzer with status ACTIVE has no active findings. Access Analyzer reviews resource policies and role trust policies to identify resources, such as S3 buckets, IAM roles, KMS keys and snapshots, that can be accessed from outside the account. Analyzers are regional and only review resources in their own region; regions without an active analyzer are not reported, so an analyzer should be created in each region in use.

Rationale

Without an active analyzer, there is no continuous visibility into resources that are shared publicly or with other accounts. Active findings that are not reviewed indicate access paths that may be unintended, allowing data to be read from outside the account, roles to be assumed by external parties, or attackers to move between accounts. Enabling the analyzer and resolving every active finding ensures that only intended external access remains.

Impact

  • Provides continuous visibility into public and cross-account access to resources

  • Helps detect unintended access before it can be exploited

  • Resolving findings may require removing permissions that some external users or accounts currently rely on

Default Value

IAM Access Analyzer is not enabled by default. No analyzer exists in any region until one is created.

Pre-Requisites

  • IAM permissions: access-analyzer:CreateAnalyzer, access-analyzer:ListAnalyzers, access-analyzer:ListFindings, access-analyzer:UpdateFindings and iam:CreateServiceLinkedRole

  • Permissions to edit the resource policies or role trust policies named in the findings

  • Confirmation from resource owners on which external access is intended

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Access analyzer in the left menu.

  3. Choose Analyzer settings and check that an analyzer exists with status Active.

  4. Open the analyzer's findings and check the number of Active findings.

  5. Repeat for each region in use.

  6. If any active analyzer has active findings, follow the implementation steps.

CLI:

List the analyzers in a region:

aws accessanalyzer list-analyzers --region <REGION> --query "analyzers[].[name,status,arn]" --output table

List the active findings of an analyzer:

aws accessanalyzer list-findings --region <REGION> --analyzer-arn <ANALYZER_ARN> --filter '{"status": {"eq": ["ACTIVE"]}}' --query "findings[].[id,resourceType,resource]" --output table

An analyzer with status ACTIVE fails if the second command returns one or more active findings. Analyzers that are not ACTIVE, and regions without an analyzer, are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Access analyzer in the left menu.

  3. If no analyzer exists, choose Analyzer settings, then Create analyzer:

    • select External access analysis,

    • enter a name and set the zone of trust to Current account (or Current organization),

    • choose Create analyzer.

  4. Open the analyzer's findings and review each Active finding.

  5. For access that is not intended, open the finding, go to the affected resource and remove the permission from its resource policy or trust policy. Then return to the finding and choose Rescan.

  6. For access that is intended, select the finding and choose Archive.

  7. Repeat for each region in use.

CLI:

Create an analyzer for the account:

aws accessanalyzer create-analyzer --region <REGION> --analyzer-name <ANALYZER_NAME> --type ACCOUNT

Archive a finding after confirming the access is intended:

aws accessanalyzer update-findings --region <REGION> --analyzer-arn <ANALYZER_ARN> --ids <FINDING_ID> --status ARCHIVED

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Access analyzer in the left menu.

  3. To reactivate an archived finding, open the Archived findings, select it and choose Unarchive.

  4. To restore a removed permission, add the original statement back to the resource policy or trust policy.

  5. To remove the analyzer, choose Analyzer settings, select the analyzer and choose Delete.

CLI:

aws accessanalyzer delete-analyzer --region <REGION> --analyzer-name <ANALYZER_NAME>

Note: deleting the analyzer removes visibility into external access. Use it only as a temporary measure.

Reference