IAM Access Analyzer Diagnostics
When to use
Any IAM Access Analyzer investigation — analyzer creation, finding management, external access detection, unused access analysis, policy validation, policy generation, or archive rule configuration.
Investigation workflow
Step 1 — Collect and triage
aws accessanalyzer list-analyzers --query 'analyzers[*].{Name:name,Arn:arn,Type:type,Status:status}'
version: "1.0.0"
last_updated: "2025-04-12"
aws accessanalyzer list-findings --analyzer-arn <arn> --filter '{"status":{"eq":["ACTIVE"]}}'
aws accessanalyzer list-archive-rules --analyzer-name <name>
Step 2 — Domain deep dive
aws accessanalyzer get-analyzer --analyzer-name <name>
aws accessanalyzer get-finding --analyzer-arn <arn> --id <finding-id>
aws accessanalyzer validate-policy --policy-document file://policy.json --policy-type IDENTITY_POLICY
Step 3 — Detailed investigation
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=access-analyzer.amazonaws.com --max-results 20
aws accessanalyzer get-generated-policy --job-id <job-id>
aws accessanalyzer list-findings --analyzer-arn <arn> --filter '{"resourceType":{"eq":["AWS::S3::Bucket"]}}'
Read references/guardrails.md before concluding on any Access Analyzer issue.
Tool quick reference
| Tool / API |
When to use |
accessanalyzer list-analyzers |
List analyzers |
accessanalyzer get-analyzer |
Get analyzer details |
accessanalyzer list-findings |
List findings with filters |
accessanalyzer get-finding |
Get finding details |
accessanalyzer validate-policy |
Validate IAM policy |
accessanalyzer start-policy-generation |
Generate policy from activity |
accessanalyzer create-archive-rule |
Create archive rule |
Gotchas: IAM Access Analyzer
- Access Analyzer has TWO types: ACCOUNT (analyzes within account) and ORGANIZATION (analyzes across organization). Organization type requires Organizations admin.
- External access findings identify resources shared with external principals (other accounts, public). This is the original Access Analyzer capability.
- Unused access findings identify unused IAM roles, access keys, passwords, and permissions. This is a newer capability with separate pricing.
- Policy validation checks IAM policies against best practices and grammar. It does NOT check if the policy is effective — only if it's well-formed.
- Policy generation creates policies based on CloudTrail activity. It requires CloudTrail logging and sufficient activity history (90 days recommended).
- Archive rules automatically archive findings matching criteria. Archived findings are NOT deleted — they're hidden from active view.
- Findings are generated asynchronously. New resources may take up to 24 hours to be analyzed.
Anti-hallucination rules
- Always cite specific analyzer ARNs, finding IDs, or API responses as evidence.
- ACCOUNT vs ORGANIZATION analyzers have different scopes. Never conflate them.
- External access and unused access are separate capabilities. Never mix them up.
- Policy validation checks grammar, not effectiveness. Never claim it validates permissions.
- Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.
14 runbooks
| Category |
IDs |
Covers |
| A — Analyzer |
A1-A2 |
Creation, configuration |
| B — Findings |
B1-B2 |
Finding management, finding resolution |
| C — External Access |
C1-C2 |
External access detection, cross-account |
| D — Unused Access |
D1-D2 |
Unused access analysis, unused permissions |
| E — Policy Validation |
E1-E2 |
Validation errors, validation best practices |
| F — Policy Generation |
F1-F2 |
Generation setup, generation results |
| G — Archive Rules |
G1-G2 |
Archive rule creation, archive management |
| Z — Catch-All |
Z1 |
General troubleshooting |
1---2name: accessanalyzer-diagnostics3description: Use this skill to investigate and troubleshoot IAM Access Analyzer problems by analyzing analyzer creation, findings, external access, unused access, policy validation, policy generation, archive rules, and following structured runbooks. Activate when: analyzer creation failures, finding issues, external access detection problems, unused access analysis errors, policy validation failures, policy generation issues, archive rule problems, or the user says something is wrong with Access Analyzer.4---56# IAM Access Analyzer Diagnostics78## When to use910Any IAM Access Analyzer investigation — analyzer creation, finding management, external access detection, unused access analysis, policy validation, policy generation, or archive rule configuration.1112## Investigation workflow1314### Step 1 — Collect and triage1516```17aws accessanalyzer list-analyzers --query 'analyzers[*].{Name:name,Arn:arn,Type:type,Status:status}'18version: "1.0.0"19last_updated: "2025-04-12"20aws accessanalyzer list-findings --analyzer-arn <arn> --filter '{"status":{"eq":["ACTIVE"]}}'21aws accessanalyzer list-archive-rules --analyzer-name <name>22```2324### Step 2 — Domain deep dive2526```27aws accessanalyzer get-analyzer --analyzer-name <name>28aws accessanalyzer get-finding --analyzer-arn <arn> --id <finding-id>29aws accessanalyzer validate-policy --policy-document file://policy.json --policy-type IDENTITY_POLICY30```3132### Step 3 — Detailed investigation3334```35aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=access-analyzer.amazonaws.com --max-results 2036aws accessanalyzer get-generated-policy --job-id <job-id>37aws accessanalyzer list-findings --analyzer-arn <arn> --filter '{"resourceType":{"eq":["AWS::S3::Bucket"]}}'38```3940Read `references/guardrails.md` before concluding on any Access Analyzer issue.4142## Tool quick reference4344| Tool / API | When to use |45|------------|-------------|46| `accessanalyzer list-analyzers` | List analyzers |47| `accessanalyzer get-analyzer` | Get analyzer details |48| `accessanalyzer list-findings` | List findings with filters |49| `accessanalyzer get-finding` | Get finding details |50| `accessanalyzer validate-policy` | Validate IAM policy |51| `accessanalyzer start-policy-generation` | Generate policy from activity |52| `accessanalyzer create-archive-rule` | Create archive rule |5354## Gotchas: IAM Access Analyzer5556- Access Analyzer has TWO types: ACCOUNT (analyzes within account) and ORGANIZATION (analyzes across organization). Organization type requires Organizations admin.57- External access findings identify resources shared with external principals (other accounts, public). This is the original Access Analyzer capability.58- Unused access findings identify unused IAM roles, access keys, passwords, and permissions. This is a newer capability with separate pricing.59- Policy validation checks IAM policies against best practices and grammar. It does NOT check if the policy is effective — only if it's well-formed.60- Policy generation creates policies based on CloudTrail activity. It requires CloudTrail logging and sufficient activity history (90 days recommended).61- Archive rules automatically archive findings matching criteria. Archived findings are NOT deleted — they're hidden from active view.62- Findings are generated asynchronously. New resources may take up to 24 hours to be analyzed.6364## Anti-hallucination rules65661. Always cite specific analyzer ARNs, finding IDs, or API responses as evidence.672. ACCOUNT vs ORGANIZATION analyzers have different scopes. Never conflate them.683. External access and unused access are separate capabilities. Never mix them up.694. Policy validation checks grammar, not effectiveness. Never claim it validates permissions.705. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.7172## 14 runbooks7374| Category | IDs | Covers |75|----------|-----|--------|76| A — Analyzer | A1-A2 | Creation, configuration |77| B — Findings | B1-B2 | Finding management, finding resolution |78| C — External Access | C1-C2 | External access detection, cross-account |79| D — Unused Access | D1-D2 | Unused access analysis, unused permissions |80| E — Policy Validation | E1-E2 | Validation errors, validation best practices |81| F — Policy Generation | F1-F2 | Generation setup, generation results |82| G — Archive Rules | G1-G2 | Archive rule creation, archive management |83| Z — Catch-All | Z1 | General troubleshooting |
aws-samples