Move toward least privilege with IAM Access Analyzer
summary
IAM Access Analyzer provides three concrete controls: policy validation that runs hundreds of checks during policy authoring and can gate CI/CD, external access findings that continuously detect external principals across one account or an organization and emit EventBridge notifications, and policy generation that scans 1–90 days of CloudTrail to produce fine‑grained action lists with resource placeholders. Access Previews simulates a policy before deployment and CloudFormation hooks can block unwanted changes, enabling automated detection, ticketing, and remediation of unintended access paths.
AI-written summary · about
chapters (11)
- 0:00Introduction to access analyzer
- 1:19Managing AWS permissions
- 2:50The journey to least privilege
- 4:21Access analyzer features
- 5:38Validating policies
- 8:24Detecting external access
- 10:40Automating security actions
- 13:07Refining unused access
- 15:11Generating granular policies
- 17:06Continuous automated review
- 18:16Summary and conclusion
related talks
41mRefine unused access confidently with IAM Access Analyzer
19mAutomatically Reducing Privilege for Access Control Policies
37mLocking Down the Security of IAM
52mIAM policy power hour
29mAiIAM: Transforming the Democratized AWS IAM...
28mYour journey to temporary credentials in the cloud
59mProvably secure authorization
25mGetting started with AWS Identity Services