Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

How to identify resources an IAM role has access to but doesn't use/ need.

0

What is the best tool to identify resources an IAM role has access to but doesn't use/ need.

I attempted using Last accessed/ CloudTrail lake / Cloudtrail API But none of these worked for various reasons:

  • Last accessed does not include the specific resource the action e.g. Decrypt was performed on
  • CloudTrail API - does not filter on useful things like arn or Rolename and it has heavy rate limits so this is not a feasible solution.

I am thinking IAM analyser internal or unused might be useful here. But don't know much about these services.

Topics
Security, Identity, & ComplianceAWS Well-Architected Framework
Tags
AWS Identity and Access ManagementIAM PoliciesSecurity
Language
English

asked 10 months ago249 views

1 Answer
0

Hello.

I think what you want to do can be achieved with IAM Access Analyzer.
As explained in the following AWS blog, you can identify unused actions from the IAM policy set for the IAM role.
https://aws.amazon.com/blogs/aws/iam-access-analyzer-updates-find-unused-access-check-policies-before-deployment/

Please note that this feature is paid and costs $0.20 per IAM user or IAM role inspected.
https://aws.amazon.com/iam/access-analyzer/pricing/

$0.20 /IAM role or user analyzed/month

EXPERT

answered 10 months ago

  • Niall B
    10 months ago

    " you can identify unused actions from the IAM policy set for the IAM role." --> Can you target a specific arn to run the analyzer against? From what I can see the unused analyser runs on the entire account rather than a specific role.

  • Riku_Kobayashi EXPERT
    10 months ago

    As you may be aware, by default all roles and IAM users are scanned. There is a setting to exclude IAM roles and IAM policies with specific tags from scanning, so you can set tags for IAM users and IAM roles that you do not want to scan, allowing you to scan only specific IAM roles. https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-create-unused.html?icmpid=docs_iam_help_panel

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content