Analyzer

Source: src/AWS/AccessAnalyzer/Analyzer.ts

An AWS IAM Access Analyzer — continuously monitors resource policies to identify resources shared with an external entity (external-access analyzers) or unused IAM access (unused-access analyzers).

The ACCOUNT external-access analyzer is free and is the common case: create one per account per Region to have Access Analyzer surface public and cross-account grants as findings.

Creating an Analyzer

Account External-Access Analyzer

import * as AWS from "alchemy/AWS";

const analyzer = yield* AWS.AccessAnalyzer.Analyzer("AccountAnalyzer", {
  type: "ACCOUNT",
});

Analyzer with Tags

const analyzer = yield* AWS.AccessAnalyzer.Analyzer("AccountAnalyzer", {
  analyzerName: "prod-external-access",
  type: "ACCOUNT",
  tags: { Environment: "prod" },
});

Unused-Access Analyzer with a Custom Tracking Period

const analyzer = yield* AWS.AccessAnalyzer.Analyzer("UnusedAccess", {
  type: "ACCOUNT_UNUSED_ACCESS",
  unusedAccessAge: "180 days",
});

Archiving Findings

const analyzer = yield* AWS.AccessAnalyzer.Analyzer("AccountAnalyzer", {});

yield* AWS.AccessAnalyzer.ArchiveRule("TrustedAccount", {
  analyzerName: analyzer.analyzerName,
  ruleName: "trusted-account",
  filter: {
    "principal.AWS": { eq: ["123456789012"] },
  },
});