AWS IAM Support
Least privilege with IAM Access Analyzer.
Most IAM policies are written broad to get a project moving and never tightened. Access Analyzer shows what is actually used, what is shared outside your account and what has gone unused. We turn that data into smaller policies without breaking applications.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Roles or users have AdministratorAccess or wildcard actions
- An audit asks who can access what, and from outside
- Buckets, roles or keys may be shared publicly or with unknown accounts
- You want to remove users, roles and permissions that nobody uses
- New policies keep getting written with Resource set to *
What you get
- A prioritized list of external and unused access findings
- Tighter policies per role, ready to merge
- CI checks that block overly permissive policies
- Alerting for new findings
How we do it
A clear, safe process you can follow along with.
1. Enable analyzers
We create an external access analyzer with the organization as the zone of trust, and an unused access analyzer, which is a paid feature, so we scope it to the accounts that matter.
2. Triage external access findings
We review each finding: is the S3 bucket, role trust policy, KMS key or queue meant to be shared? Intended ones are archived with a rule, unintended ones are fixed in the resource policy.
3. Review unused access findings
These list unused roles, users, access keys, passwords and services or actions never used in a tracking window. We confirm with owners before removing anything.
4. Generate policies from activity
For a role, Access Analyzer reads CloudTrail over a chosen period and drafts a policy covering the actions used. We review it, add actions needed for rare jobs, such as quarterly reports, and replace wildcards in resources.
5. Validate before applying
We run policy validation for errors, warnings and security findings and use custom policy checks to prevent regressions in CI.
6. Roll out safely and keep it going
We attach the tighter policy alongside the old one, monitor AccessDenied in CloudTrail, then detach the old policy. Findings are routed to EventBridge so new ones get attention.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Trusting a short activity window
Rare jobs may not appear. Choose a window that covers them or add the actions manually.
Deleting unused roles blindly
A role used once a year looks unused. Verify with the owner first.
Archiving every finding
Archive only intended sharing, with a specific rule.
One-time cleanup
Permissions drift back without automated checks.
Frequently Asked Questions
What does IAM Access Analyzer do?
It finds resources shared outside your zone of trust, identifies unused permissions and credentials, validates policies and can generate least-privilege policies from CloudTrail activity.
Is IAM Access Analyzer free?
External access analysis and policy validation are available without a separate charge, while unused access analysis is billed. Check current AWS pricing for your volume.
Can Access Analyzer generate a policy automatically?
Yes, from CloudTrail activity for a role or user. The draft needs review because it only reflects actions seen in the chosen period.
Want Help With Least privilege with IAM Access Analyzer?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required