Back to Checks
aws

IAM Access Analyzer analyzer is active and has no active findings

accessanalyzer_enabled_without_findings
Service: accessanalyzerSeverity: low
OfficialBuilt-inVerified
Categories:identity-accesstrust-boundariesinternet-exposed
Resource Type:Other

IAM Access Analyzer analyzers are in Active state and currently report zero Active findings within their scope of monitored resources.

Prowler logoProwlerprowler-provider-aws

Risk

Unresolved Active findings indicate unintended external or internal access paths.

  • Confidentiality: public/cross-account reads of data (buckets, snapshots, secrets)
  • Integrity: rogue role assumption or KMS use enabling policy/data changes
  • Lateral movement across accounts

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks accessanalyzer_enabled_without_findings

Recommendation

Enable IAM Access Analyzer in all relevant Regions and org/account scopes. Triage every Active finding:

  • Remove unintended access by tightening resource and trust policies
  • Enforce least privilege and separation of duties
  • Archive only validated, intended access
  • Continuously monitor and automate reviews

Remediation

Terraform

resource "aws_accessanalyzer_analyzer" "example_resource" {
  analyzer_name = "example_resource"
  type          = "ACCOUNT" # This line fixes the security issue
}

NativeIaC

Resources:
  example_resource:
    Type: AWS::AccessAnalyzer::Analyzer
    Properties:
      AnalyzerName: example_resource
      Type: ACCOUNT  # This line fixes the security issue

Other

1In the AWS Console, go to IAM > Access analyzer
2If no analyzer exists, click Create analyzer, select Type: Account, name it example_resource, and click Create
3To clear active findings: under Resource analysis, select your analyzer, select all Active findings, choose Actions > Archive
4For unintended access findings, open the finding and follow the linked resource to remove the offending permission (edit the resource policy or role trust policy), then return to the finding and choose Rescan
5Confirm the dashboard shows 0 Active findings

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.accessanalyzer.accessanalyzer_client import (
    accessanalyzer_client,
)


class accessanalyzer_enabled_without_findings(Check):
    def execute(self):
        findings = []
        for analyzer in accessanalyzer_client.analyzers:
            report = Check_Report_AWS(metadata=self.metadata(), resource=analyzer)
            if analyzer.status == "ACTIVE":
                report.status = "PASS"
                report.status_extended = f"IAM Access Analyzer {analyzer.name} does not have active findings."

                if len(analyzer.findings) != 0:
                    active_finding_counter = 0
                    for finding in analyzer.findings:
                        if finding.status == "ACTIVE":
                            active_finding_counter += 1

                    if active_finding_counter > 0:
                        report.status = "FAIL"
                        report.status_extended = f"IAM Access Analyzer {analyzer.name} has {active_finding_counter} active findings."

                findings.append(report)

        return findings

References