Identity and Access Management Access Analyzer helps identify potential resource-access risks by enabling you to identify any policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview and validate public and cross-account access to your resources before deploying permissions changes. This guide describes the Identity and Access Management Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see Identity and Access Management Access Analyzer in the IAM User Guide.
To start using IAM Access Analyzer, you first need to create an analyzer.
x-logo: url: https://api.apis.guru/v2/cache/logo/https_twitter.com_awscloud_profile_image.png backgroundColor: '#FFFFFF' termsOfService: https://aws.amazon.com/service-terms/ contact: name: Mike Ralphson email: mike.ralphson@gmail.com url: https://github.com/mermade/aws2openapi x-twitter: PermittedSoc license: name: Apache 2.0 License url: http://www.apache.org/licenses/ x-providerName: amazonaws.com x-serviceName: accessanalyzer x-aws-signingName: access-analyzer x-origin: - contentType: application/json url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/accessanalyzer-2019-11-01.normal.json converter: url: https://github.com/mermade/aws2openapi version: 1.0.0 x-apisguru-driver: external x-apiClientRegistration: url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct x-apisguru-categories: - cloud x-preferred: true servers: - url: http://access-analyzer.{region}.amazonaws.com variables: region: description: The AWS region enum: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - us-gov-west-1 - us-gov-east-1 - ca-central-1 - eu-north-1 - eu-west-1 - eu-west-2 - eu-west-3 - eu-central-1 - eu-south-1 - af-south-1 - ap-northeast-1 - ap-northeast-2 - ap-northeast-3 - ap-southeast-1 - ap-southeast-2 - ap-east-1 - ap-south-1 - sa-east-1 - me-south-1 default: us-east-1 description: The Access Analyzer multi-region endpoint - url: https://access-analyzer.{region}.amazonaws.com variables: region: description: The AWS region enum: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - us-gov-west-1 - us-gov-east-1 - ca-central-1 - eu-north-1 - eu-west-1 - eu-west-2 - eu-west-3 - eu-central-1 - eu-south-1 - af-south-1 - ap-northeast-1 - ap-northeast-2 - ap-northeast-3 - ap-southeast-1 - ap-southeast-2 - ap-east-1 - ap-south-1 - sa-east-1 - me-south-1 default: us-east-1 description: The Access Analyzer multi-region endpoint - url: http://access-analyzer.{region}.amazonaws.com.cn variables: region: description: The AWS region enum: - cn-north-1 - cn-northwest-1 default: cn-north-1 description: The Access Analyzer endpoint for China (Beijing) and China (Ningxia) - url: https://access-analyzer.{region}.amazonaws.com.cn variables: region: description: The AWS region enum: - cn-north-1 - cn-northwest-1 default: cn-north-1 description: The Access Analyzer endpoint for China (Beijing) and China (Ningxia) security: - hmac: [] tags: - name: Analyzed Resource paths: /analyzed-resource: parameters: - $ref: '#/components/parameters/X-Amz-Content-Sha256' - $ref: '#/components/parameters/X-Amz-Date' - $ref: '#/components/parameters/X-Amz-Algorithm' - $ref: '#/components/parameters/X-Amz-Credential' - $ref: '#/components/parameters/X-Amz-Security-Token' - $ref: '#/components/parameters/X-Amz-Signature' - $ref: '#/components/parameters/X-Amz-SignedHeaders' post: operationId: ListAnalyzedResources description: Retrieves a list of resources of the specified type that have been analyzed by the specified analyzer.. responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/ListAnalyzedResourcesResponse' '480': description: ResourceNotFoundException content: application/json: schema: $ref: '#/components/schemas/ResourceNotFoundException' '481': description: ValidationException content: application/json: schema: $ref: '#/components/schemas/ValidationException' '482': description: InternalServerException content: application/json: schema: $ref: '#/components/schemas/InternalServerException' '483': description: ThrottlingException content: application/json: schema: $ref: '#/components/schemas/ThrottlingException' '484': description: AccessDeniedException content: application/json: schema: $ref: '#/components/schemas/AccessDeniedException' parameters: - name: maxResults in: query schema: type: string description: Pagination limit required: false - name: nextToken in: query schema: type: string description: Pagination token required: false requestBody: required: true content: application/json: schema: type: object required: - analyzerArn properties: analyzerArn: description: The ARN of the analyzer to retrieve a list of analyzed resources from. type: string pattern: '[^:]*:[^:]*:[^:]*:[^:]*:[^:]*:analyzer/.{1,255}' resourceType: description: The type of resource. type: string enum: - AWS::S3::Bucket - AWS::IAM::Role - AWS::SQS::Queue - AWS::Lambda::Function - AWS::Lambda::LayerVersion - AWS::KMS::Key - AWS::SecretsManager::Secret - AWS::EFS::FileSystem - AWS::EC2::Snapshot - AWS::ECR::Repository - AWS::RDS::DBSnapshot - AWS::RDS::DBClusterSnapshot - AWS::SNS::Topic nextToken: description: A token used for pagination of results returned. type: string maxResults: description: The maximum number of results to return in the response. type: integer x-microcks-operation: delay: 0 dispatcher: FALLBACK summary: Amazon IAM Access Analyzer List Analyzed Resources tags: - Analyzed Resource components: parameters: X-Amz-Credential: name: X-Amz-Credential in: header schema: type: string required: false X-Amz-Algorithm: name: X-Amz-Algorithm in: header schema: type: string required: false X-Amz-Content-Sha256: name: X-Amz-Content-Sha256 in: header schema: type: string required: false X-Amz-Security-Token: name: X-Amz-Security-Token in: header schema: type: string required: false X-Amz-SignedHeaders: name: X-Amz-SignedHeaders in: header schema: type: string required: false X-Amz-Date: name: X-Amz-Date in: header schema: type: string required: false X-Amz-Signature: name: X-Amz-Signature in: header schema: type: string required: false schemas: String: type: string InternalServerException: {} Token: type: string ThrottlingException: {} ListAnalyzedResourcesResponse: type: object required: - analyzedResources properties: analyzedResources: allOf: - $ref: '#/components/schemas/AnalyzedResourcesList' - description: A list of resources that were analyzed. nextToken: allOf: - $ref: '#/components/schemas/Token' - description: A token used for pagination of results returned. description: The response to the request. ResourceType: type: string enum: - AWS::S3::Bucket - AWS::IAM::Role - AWS::SQS::Queue - AWS::Lambda::Function - AWS::Lambda::LayerVersion - AWS::KMS::Key - AWS::SecretsManager::Secret - AWS::EFS::FileSystem - AWS::EC2::Snapshot - AWS::ECR::Repository - AWS::RDS::DBSnapshot - AWS::RDS::DBClusterSnapshot - AWS::SNS::Topic AnalyzedResourcesList: type: array items: $ref: '#/components/schemas/AnalyzedResourceSummary' ResourceNotFoundException: {} AccessDeniedException: {} ValidationException: {} ResourceArn: type: string pattern: arn:[^:]*:[^:]*:[^:]*:[^:]*:.* AnalyzedResourceSummary: type: object required: - resourceArn - resourceOwnerAccount - resourceType properties: resourceArn: allOf: - $ref: '#/components/schemas/ResourceArn' - description: The ARN of the analyzed resource. resourceOwnerAccount: allOf: - $ref: '#/components/schemas/String' - description: The Amazon Web Services account ID that owns the resource. resourceType: allOf: - $ref: '#/components/schemas/ResourceType' - description: The type of resource that was analyzed. description: Contains the ARN of the analyzed resource. securitySchemes: hmac: type: apiKey name: Authorization in: header description: Amazon Signature authorization v4 x-amazon-apigateway-authtype: awsSigv4 externalDocs: description: Amazon Web Services documentation url: https://docs.aws.amazon.com/access-analyzer/ x-hasEquivalentPaths: true