ArchiveRule

Source: src/AWS/AccessAnalyzer/ArchiveRule.ts

An archive rule for an IAM Access Analyzer — automatically archives new findings that match the filter criteria, so expected cross-account or public grants don’t clutter the active findings list.

Archive rules apply only to findings created after the rule; existing findings are unaffected.

Creating Archive Rules

Archive Findings from a Trusted Account

import * as AWS from "alchemy/AWS";

const analyzer = yield* AWS.AccessAnalyzer.Analyzer("AccountAnalyzer", {});

yield* AWS.AccessAnalyzer.ArchiveRule("TrustedAccount", {
  analyzerName: analyzer.analyzerName,
  ruleName: "trusted-account",
  filter: {
    "principal.AWS": { eq: ["123456789012"] },
  },
});

Archive Public S3 Findings

yield* AWS.AccessAnalyzer.ArchiveRule("PublicBuckets", {
  analyzerName: analyzer.analyzerName,
  ruleName: "public-buckets",
  filter: {
    resourceType: { eq: ["AWS::S3::Bucket"] },
    isPublic: { eq: ["true"] },
  },
});