Back to Checks
aws

IAM Access Analyzer is enabled

accessanalyzer_enabled
Service: accessanalyzerSeverity: low
OfficialBuilt-inVerified
Categories:identity-accesstrust-boundaries
Resource Type:Other

IAM Access Analyzer presence and status are evaluated per account and Region. An analyzer in ACTIVE state indicates continuous analysis of supported resources and IAM activity to identify external, internal, and unused access.

Prowler logoProwlerprowler-provider-aws

Risk

Without an active analyzer, visibility into unintended public, cross-account, or risky internal access is lost. Adversaries can exploit exposed S3, snapshots, KMS keys, or permissive role trusts for data exfiltration and escalation. Unused permissions persist, enlarging the attack surface. This degrades confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks accessanalyzer_enabled

Recommendation

Enable IAM Access Analyzer across all accounts and active Regions (or organization-wide). Operate on least privilege: continuously review findings, remove unintended access, and trim unused permissions. Use archive rules sparingly, integrate reviews into change/CI/CD workflows, and enforce separation of duties on policy changes.

Remediation

CLI

aws accessanalyzer create-analyzer --analyzer-name example_resource --type ACCOUNT

Terraform

resource "aws_accessanalyzer_analyzer" "example_resource" {
  analyzer_name = "example_resource"
  type          = "ACCOUNT" # This line fixes the security issue
}

NativeIaC

Resources:
  example_resource:
    Type: AWS::AccessAnalyzer::Analyzer  # This resource enables IAM Access Analyzer
    Properties:
      AnalyzerName: example_resource
      Type: ACCOUNT  # This line fixes the security issue

Other

1In the AWS Console, open IAM
2Go to Access analyzer > Analyzer settings
3Confirm the desired Region
4Click Create analyzer
5Select Resource analysis - External access
6Set Name to "example_resource" and Zone of trust to "Current account"
7Click Create

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.accessanalyzer.accessanalyzer_client import (
    accessanalyzer_client,
)


class accessanalyzer_enabled(Check):
    def execute(self):
        findings = []
        for analyzer in accessanalyzer_client.analyzers:
            report = Check_Report_AWS(metadata=self.metadata(), resource=analyzer)
            if analyzer.status == "ACTIVE":
                report.status = "PASS"
                report.status_extended = (
                    f"IAM Access Analyzer {analyzer.name} is enabled."
                )

            else:
                if analyzer.status == "NOT_AVAILABLE":
                    report.status = "FAIL"
                    report.status_extended = f"IAM Access Analyzer in account {accessanalyzer_client.audited_account} is not enabled."

                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"IAM Access Analyzer {analyzer.name} is not active."
                    )
                if (
                    accessanalyzer_client.audit_config.get(
                        "mute_non_default_regions", False
                    )
                    and not analyzer.region == accessanalyzer_client.region
                ):
                    report.muted = True

            findings.append(report)

        return findings

References