Refine unused access confidently with IAM Access Analyzer
summary
AWS IAM Access Analyzer shows where permissions go unused across an organization, surfaces unused access recommendations (at no extra cost) and provides step‑by‑step fixes for keys, passwords, roles and principals; it aggregates findings in a centralized dashboard, pushes alerts via EventBridge and integrates with Security Hub. Policy generation uses CloudTrail for fine‑grained policies across ~200 services, last‑access data inspects individual principals, and custom policy checks (CheckNoNewAccess, CheckAccessNotGranted, public/resource rules) use automated reasoning and are available via API/CLI for CI/CD enforcement.
AI-written summary · about
chapters (4)
- 0:00Introduction and concepts
- 17:51Demo: Unused access
- 23:12Custom policy checks
- 32:09Demo and conclusion
related talks
19mMove toward least privilege with IAM Access Analyzer
19mAutomatically Reducing Privilege for Access Control Policies
37mLocking Down the Security of IAM
28mYour journey to temporary credentials in the cloud
25mIdentifying and Reducing Permission Explosion in AWS: A Graph-Based and Analytical Approach
29mAiIAM: Transforming the Democratized AWS IAM...
38mChanging Perspectives: A Deep Dive into the Security Posture of 600+ Real-World AWS Environments
25mGetting started with AWS Identity Services