Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.
External access analyzers help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.
Unused access analyzers help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.
Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs.
This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see Identity and Access Management Access Analyzer in the IAM User Guide.
tags: - name: 2015 02 01 paths: /2015-02-01/access-points: GET: summary: Amazon Web Services Describeaccesspoints description: Returns the description of a specific Amazon EFS access point if the AccessPointId is provided. If you provide an EFS FileSystemId, it returns descriptions of all access points for that file system. You can provide either an AccessPointId or a FileSystemId in the request, but not both. This operation requires permissions for the elasticfilesystem:DescribeAccessPoints action. operationId: amazonWebServicesDescribeAccessPoints tags: - 2015 02 01 /2015-02-01/file-systems: GET: summary: Amazon Web Services Describefilesystems description: 'Returns the description of a specific Amazon EFS file system if either the file system CreationToken or the FileSystemId is provided. Otherwise, it returns descriptions of all file systems owned by the caller''s Amazon Web Services account in the Amazon Web Services Region of the endpoint that you''re calling. When retrieving all file system descriptions, you can optionally specify the MaxItems parameter to limit the number of descriptions in a response. This number is automatically set to 100. If more file system descriptions remain, Amazon EFS returns a NextMarker, an opaque token, in the response. In this case, you should send a subsequent request with the Marker request parameter set to the value of NextMarker. To retrieve a list of your file system descriptions, this operation is used in an iterative process, where DescribeFileSystems is called first without the Marker and then the operation continues to call it with the Marker parameter set to the value of the NextMarker from the previous response until the response has no NextMarker. The order of file systems returned in the response of one DescribeFileSystems call and the order of file systems returned across the responses of a multi-call iteration is unspecified. This operation requires permissions for the elasticfilesystem:DescribeFileSystems action. ' operationId: amazonWebServicesDescribeFileSystems tags: - 2015 02 01 /2015-02-01/mount-targets: GET: summary: Amazon Web Services Describemounttargets description: Returns the descriptions of all the current mount targets, or a specific mount target, for a file system. When requesting all of the current mount targets, the order of mount targets returned in the response is unspecified. This operation requires permissions for the elasticfilesystem:DescribeMountTargets action, on either the file system ID that you specify in FileSystemId, or on the file system of the mount target that you specify in MountTargetId. operationId: amazonWebServicesDescribeMountTargets tags: - 2015 02 01 /2015-02-01/file-systems/{SourceFileSystemId}/replication-configuration: DELETE: summary: Amazon Web Services Deletereplicationconfiguration description: 'Deletes a replication configuration. Deleting a replication configuration ends the replication process. After a replication configuration is deleted, the destination file system becomes Writeable and its replication overwrite protection is re-enabled. For more information, see Delete a replication configuration. This operation requires permissions for the elasticfilesystem:DeleteReplicationConfiguration action. ' operationId: amazonWebServicesDeleteReplicationConfiguration tags: - 2015 02 01 /2015-02-01/create-tags/{FileSystemId}: POST: summary: Amazon Web Services Createtags description: ' DEPRECATED - CreateTags is deprecated and not maintained. To create tags for EFS resources, use the API action. Creates or overwrites tags associated with a file system. Each tag is a key-value pair. If a tag key specified in the request already exists on the file system, this operation overwrites its value with the value provided in the request. If you add the Name tag to your file system, Amazon EFS returns it in the response to the DescribeFileSystems operation. This operation requires permission for the elasticfilesystem:CreateTags action.' operationId: amazonWebServicesCreateTags tags: - 2015 02 01 /2015-02-01/access-points/{AccessPointId}: DELETE: summary: Amazon Web Services Deleteaccesspoint description: Deletes the specified access point. After deletion is complete, new clients can no longer connect to the access points. Clients connected to the access point at the time of deletion will continue to function until they terminate their connection. This operation requires permissions for the elasticfilesystem:DeleteAccessPoint action. operationId: amazonWebServicesDeleteAccessPoint tags: - 2015 02 01 /2015-02-01/file-systems/{FileSystemId}: PUT: summary: Amazon Web Services Updatefilesystem description: Updates the throughput mode or the amount of provisioned throughput of an existing file system. operationId: amazonWebServicesUpdateFileSystem tags: - 2015 02 01 /2015-02-01/file-systems/{FileSystemId}/policy: PUT: summary: Amazon Web Services Putfilesystempolicy description: Applies an Amazon EFS FileSystemPolicy to an Amazon EFS file system. A file system policy is an IAM resource-based policy and can contain multiple policy statements. A file system always has exactly one file system policy, which can be the default policy or an explicit policy set or updated using this API operation. EFS file system policies have a 20,000 character limit. When an explicit policy is set, it overrides the default policy. For more information about the default file system policy, see Default EFS File System Policy. EFS file system policies have a 20,000 character limit. This operation requires permissions for the elasticfilesystem:PutFileSystemPolicy action. operationId: amazonWebServicesPutFileSystemPolicy tags: - 2015 02 01 /2015-02-01/mount-targets/{MountTargetId}: DELETE: summary: Amazon Web Services Deletemounttarget description: 'Deletes the specified mount target. This operation forcibly breaks any mounts of the file system by using the mount target that is being deleted, which might disrupt instances or applications using those mounts. To avoid applications getting cut off abruptly, you might consider unmounting any mounts of the mount target, if feasible. The operation also deletes the associated network interface. Uncommitted writes might be lost, but breaking a mount target using this operation does not corrupt the file system itself. The file system you created remains. You can mount an EC2 instance in your VPC by using another mount target. This operation requires permissions for the following action on the file system: elasticfilesystem:DeleteMountTarget The DeleteMountTarget call returns while the mount target state is still deleting. You can check the mount target deletion by calling the DescribeMountTargets operation, which returns a list of mount target descriptions for the given file system. The operation also requires permissions for the following Amazon EC2 action on the mount target''s network interface: ec2:DeleteNetworkInterface ' operationId: amazonWebServicesDeleteMountTarget tags: - 2015 02 01 /2015-02-01/delete-tags/{FileSystemId}: POST: summary: Amazon Web Services Deletetags description: ' DEPRECATED - DeleteTags is deprecated and not maintained. To remove tags from EFS resources, use the API action. Deletes the specified tags from a file system. If the DeleteTags request includes a tag key that doesn''t exist, Amazon EFS ignores it and doesn''t cause an error. For more information about tags and related restrictions, see Tag restrictions in the Billing and Cost Management User Guide. This operation requires permissions for the elasticfilesystem:DeleteTags action.' operationId: amazonWebServicesDeleteTags tags: - 2015 02 01 /2015-02-01/account-preferences: PUT: summary: Amazon Web Services Putaccountpreferences description: 'Use this operation to set the account preference in the current Amazon Web Services Region to use long 17 character (63 bit) or short 8 character (32 bit) resource IDs for new EFS file system and mount target resources. All existing resource IDs are not affected by any changes you make. You can set the ID preference during the opt-in period as EFS transitions to long resource IDs. For more information, see Managing Amazon EFS resource IDs. Starting in October, 2021, you will receive an error if you try to set the account preference to use the short 8 character format resource ID. Contact Amazon Web Services support if you receive an error and must use short IDs for file system and mount target resources. ' operationId: amazonWebServicesPutAccountPreferences tags: - 2015 02 01 /2015-02-01/file-systems/{FileSystemId}/backup-policy: PUT: summary: Amazon Web Services Putbackuppolicy description: 'Updates the file system''s backup policy. Use this action to start or stop automatic backups of the file system. ' operationId: amazonWebServicesPutBackupPolicy tags: - 2015 02 01 /2015-02-01/file-systems/{FileSystemId}/lifecycle-configuration: PUT: summary: Amazon Web Services Putlifecycleconfiguration description: 'Use this action to manage storage for your file system. A LifecycleConfiguration consists of one or more LifecyclePolicy objects that define the following: TransitionToIA – When to move files in the file system from primary storage (Standard storage class) into the Infrequent Access (IA) storage. TransitionToArchive – When to move files in the file system from their current storage class (either IA or Standard storage) into the Archive storage. File systems cannot transition into Archive storage before transitioning into IA storage. Therefore, TransitionToArchive must either not be set or must be later than TransitionToIA. The Archive storage class is available only for file systems that use the Elastic Throughput mode and the General Purpose Performance mode. TransitionToPrimaryStorageClass – Whether to move files in the file system back to primary storage (Standard storage class) after they are accessed in IA or Archive storage. For more information, see Managing file system storage. Each Amazon EFS file system supports one lifecycle configuration, which applies to all files in the file system. If a LifecycleConfiguration object already exists for the specified file system, a PutLifecycleConfiguration call modifies the existing configuration. A PutLifecycleConfiguration call with an empty LifecyclePolicies array in the request body deletes any existing LifecycleConfiguration. In the request, specify the following: The ID for the file system for which you are enabling, disabling, or modifying Lifecycle management. A LifecyclePolicies array of LifecyclePolicy objects that define when to move files to IA storage, to Archive storage, and back to primary storage. Amazon EFS requires that each LifecyclePolicy object have only have a single transition, so the LifecyclePolicies array needs to be structured with separate LifecyclePolicy objects. See the example requests in the following section for more information. This operation requires permissions for the elasticfilesystem:PutLifecycleConfiguration operation. To apply a LifecycleConfiguration object to an encrypted file system, you need the same Key Management Service permissions as when you created the encrypted file system.' operationId: amazonWebServicesPutLifecycleConfiguration tags: - 2015 02 01 /2015-02-01/mount-targets/{MountTargetId}/security-groups: PUT: summary: Amazon Web Services Modifymounttargetsecuritygroups description: 'Modifies the set of security groups in effect for a mount target. When you create a mount target, Amazon EFS also creates a new network interface. For more information, see CreateMountTarget. This operation replaces the security groups in effect for the network interface associated with a mount target, with the SecurityGroups provided in the request. This operation requires that the network interface of the mount target has been created and the lifecycle state of the mount target is not deleted. The operation requires permissions for the following actions: elasticfilesystem:ModifyMountTargetSecurityGroups action on the mount target''s file system. ec2:ModifyNetworkInterfaceAttribute action on the mount target''s network interface. ' operationId: amazonWebServicesModifyMountTargetSecurityGroups tags: - 2015 02 01 /2015-02-01/file-systems/replication-configurations: GET: summary: Amazon Web Services Describereplicationconfigurations description: Retrieves the replication configuration for a specific file system. If a file system is not specified, all of the replication configurations for the Amazon Web Services account in an Amazon Web Services Region are retrieved. operationId: amazonWebServicesDescribeReplicationConfigurations tags: - 2015 02 01 /2015-02-01/tags/{FileSystemId}/: GET: summary: Amazon Web Services Describetags description: ' DEPRECATED - The DescribeTags action is deprecated and not maintained. To view tags associated with EFS resources, use the ListTagsForResource API action. Returns the tags associated with a file system. The order of tags returned in the response of one DescribeTags call and the order of tags returned across the responses of a multiple-call iteration (when using pagination) is unspecified. This operation requires permissions for the elasticfilesystem:DescribeTags action. ' operationId: amazonWebServicesDescribeTags tags: - 2015 02 01 /2015-02-01/resource-tags/{ResourceId}: DELETE: summary: Amazon Web Services Untagresource description: Removes tags from an EFS resource. You can remove tags from EFS file systems and access points using this API operation. This operation requires permissions for the elasticfilesystem:UntagResource action. operationId: amazonWebServicesUntagResource tags: - 2015 02 01 /2015-02-01/file-systems/{FileSystemId}/protection: PUT: summary: Amazon Web Services Updatefilesystemprotection description: 'Updates protection on the file system. This operation requires permissions for the elasticfilesystem:UpdateFileSystemProtection action. ' operationId: amazonWebServicesUpdateFileSystemProtection tags: - 2015 02 01