The AWS Identity and Access Management (IAM) access analyaer guides you towards least privilege by providing tools to set, verify and refine permissions. IAM access analyser provides access analysis findings, policy checks and policy generation.

When you enable IAM access analyser, you create an analyser, which regularly checks your accounts or AWS organisation for external access and unused access. The analyser generates access findings for your IAM roles, IAM users and AWS resources. You can enable two types of analysers: external access analyser and unused access analyser:

• an external access analyser creates public and cross-account access findings for AWS resources. This is provided at no additional charge.
• An unused access analyser inspects unused access to guide you towards least privilege. This is a paid feature. For every unused access analyser you enable, you pay per IAM role or IAM user per month. Because IAM roles and users are global, you need to enable only one analyser across all regions in a partition.

Unused access analyser charges occur once during set-up, and then monthly on the first day of the month.

IAM access analyser also offers two types of policy checks:

• IAM access analyser policy validation guides you to author and validate secure and functional policies based on IAM best practices. This is provided at no additional charge.
• IAM access analyser customised policy checks validate before deployment so that developer-authored policies adhere to your specified security standards. This is a paid feature. Customised policy checks use automated reasoning – provable security assurance backed by mathematical proof – so that security teams can proactively detect non-conformant updates to policies. For customised policy checks, you are charged based on the number of checks you run by calling the IAM access analyser APIs.

IAM access analyser policy generation creates fine-grained policies based on the access activity captured in your logs. This is provided at no additional charge.