Help us improve the AWS re:Post Knowledge Center by sharing your feedback in a brief survey. Your input can influence how we create and update our content to better support your AWS journey.
How do I use AWS IAM Access Analyzer to monitor my AWS resources in my AWS Organizations accounts?
I want to use AWS Identity and Access Management Access Analyzer to identify resources in my organization and accounts that I share with an external entity.
Short description
To monitor external access to resources across your organization, use your organization's management account to create external access analyzers in each AWS Region. You can also add a member account in your organization as a delegated administrator for IAM Access Analyzer.
Note: Only the management account can add a delegated administrator.
Resolution
You can use either the IAM console or the AWS Command Line Interface (AWS CLI) to create the external access analyzer.
Use the IAM console
From your organization's management or delegated administrator account, use the IAM console to create the IAM Access Analyzer external access analyzer.
Use the AWS CLI
Note: If you receive errors when you run AWS CLI commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.
Run the following create-analyzer command:
aws accessanalyzer create-analyzer —analyzer-name example —type ORGANIZATION
Check the status of your analyzers
You can view the status of your external access analyzers in the Analyzers section of the IAM console.
Related information
Using AWS Identity and Access Management Access Analyzer
IAM Access Analyzer supported resource types for external and internal access
- Language
- English
IAM Access Analyzer has a suite of features. The above Knowledge Center post is talking about external access analysis. This feature is offered at no additional charges to customers. It analyzes resource permissions. Since those resources are regional, it is recommended to create an analyzer in each region where you have resources that need to be analyzed. IAM Access Analyzer has another analyzer type for its unused access analysis. Unused access analysis is a paid offering and analyzes IAM users and roles permissions, which are not regional. Hence, you only need a single unused access analyzer. I think we just need the Knowledge Center post to specify that the guidance is for external access analysis.
Relevant content
- asked 4 years ago
- asked a year ago
