Check provider logo

IAM Access Analyzer analyzer is active and has no active findings

accessanalyzer_enabled_without_findings

Severitylow
Serviceaccessanalyzer
by Prowler
identity-accesstrust-boundariesinternet-exposed

IAM Access Analyzer analyzers are in Active state and currently report zero Active findings within their scope of monitored resources.

Risk

Unresolved Active findings indicate unintended external or internal access paths.

  • Confidentiality: public/cross-account reads of data (buckets, snapshots, secrets)
  • Integrity: rogue role assumption or KMS use enabling policy/data changes
  • Lateral movement across accounts
Run this check with Prowler CLI

prowler aws --checks accessanalyzer_enabled_without_findings

Run in Prowler Cloud

Recommendation

Enable IAM Access Analyzer in all relevant Regions and org/account scopes. Triage every Active finding:

  • Remove unintended access by tightening resource and trust policies
  • Enforce least privilege and separation of duties
  • Archive only validated, intended access
  • Continuously monitor and automate reviews

Remediation

Native IAC
Resources:
  example_resource:
    Type: AWS::AccessAnalyzer::Analyzer
    Properties:
      AnalyzerName: example_resource
      Type: ACCOUNT  # This line fixes the security issue
Terraform
resource "aws_accessanalyzer_analyzer" "example_resource" {
  analyzer_name = "example_resource"
  type          = "ACCOUNT" # This line fixes the security issue
}
Other
  1. In the AWS Console, go to IAM > Access analyzer
  2. If no analyzer exists, click Create analyzer, select Type: Account, name it example_resource, and click Create
  3. To clear active findings: under Resource analysis, select your analyzer, select all Active findings, choose Actions > Archive
  4. For unintended access findings, open the finding and follow the linked resource to remove the offending permission (edit the resource policy or role trust policy), then return to the finding and choose Rescan
  5. Confirm the dashboard shows 0 Active findings

Source Code

Resource Type

Other

References