Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.
External access analyzers help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.
Unused access analyzers help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.
Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs.
This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see Identity and Access Management Access Analyzer in the IAM User Guide.
tags: - name: 2020 11 20 paths: /2020-11-20/projects/{projectName}/datasets: POST: summary: Amazon Web Services Createdataset description: Creates a new dataset in an Amazon Lookout for Vision project. CreateDataset can create a training or a test dataset from a valid dataset source (DatasetSource). If you want a single dataset project, specify train for the value of DatasetType. To have a project with separate training and test datasets, call CreateDataset twice. On the first call, specify train for the value of DatasetType. On the second call, specify test for the value of DatasetType. This operation requires permissions to perform the lookoutvision:CreateDataset operation. operationId: amazonWebServicesCreateDataset tags: - 2020 11 20 /2020-11-20/projects/{projectName}/models: GET: summary: Amazon Web Services Listmodels description: Lists the versions of a model in an Amazon Lookout for Vision project. The ListModels operation is eventually consistent. Recent calls to CreateModel might take a while to appear in the response from ListProjects. This operation requires permissions to perform the lookoutvision:ListModels operation. operationId: amazonWebServicesListModels tags: - 2020 11 20 /2020-11-20/projects: GET: summary: Amazon Web Services Listprojects description: Lists the Amazon Lookout for Vision projects in your AWS account that are in the AWS Region in which you call ListProjects. The ListProjects operation is eventually consistent. Recent calls to CreateProject and DeleteProject might take a while to appear in the response from ListProjects. This operation requires permissions to perform the lookoutvision:ListProjects operation. operationId: amazonWebServicesListProjects tags: - 2020 11 20 /2020-11-20/projects/{projectName}/datasets/{datasetType}: GET: summary: Amazon Web Services Describedataset description: Describe an Amazon Lookout for Vision dataset. This operation requires permissions to perform the lookoutvision:DescribeDataset operation. operationId: amazonWebServicesDescribeDataset tags: - 2020 11 20 /2020-11-20/projects/{projectName}/models/{modelVersion}: GET: summary: Amazon Web Services Describemodel description: Describes a version of an Amazon Lookout for Vision model. This operation requires permissions to perform the lookoutvision:DescribeModel operation. operationId: amazonWebServicesDescribeModel tags: - 2020 11 20 /2020-11-20/projects/{projectName}: GET: summary: Amazon Web Services Describeproject description: Describes an Amazon Lookout for Vision project. This operation requires permissions to perform the lookoutvision:DescribeProject operation. operationId: amazonWebServicesDescribeProject tags: - 2020 11 20 /2020-11-20/projects/{projectName}/modelpackagingjobs/{jobName}: GET: summary: Amazon Web Services Describemodelpackagingjob description: 'Describes an Amazon Lookout for Vision model packaging job. This operation requires permissions to perform the lookoutvision:DescribeModelPackagingJob operation. For more information, see Using your Amazon Lookout for Vision model on an edge device in the Amazon Lookout for Vision Developer Guide. ' operationId: amazonWebServicesDescribeModelPackagingJob tags: - 2020 11 20 /2020-11-20/projects/{projectName}/models/{modelVersion}/detect: POST: summary: Amazon Web Services Detectanomalies description: Detects anomalies in an image that you supply. The response from DetectAnomalies includes a boolean prediction that the image contains one or more anomalies and a confidence value for the prediction. If the model is an image segmentation model, the response also includes segmentation information for each type of anomaly found in the image. Before calling DetectAnomalies, you must first start your model with the StartModel operation. You are charged for the amount of time, in minutes, that a model runs and for the number of anomaly detection units that your model uses. If you are not using a model, use the StopModel operation to stop your model. For more information, see Detecting anomalies in an image in the Amazon Lookout for Vision developer guide. This operation requires permissions to perform the lookoutvision:DetectAnomalies operation. operationId: amazonWebServicesDetectAnomalies tags: - 2020 11 20 /2020-11-20/projects/{projectName}/datasets/{datasetType}/entries: PATCH: summary: Amazon Web Services Updatedatasetentries description: Adds or updates one or more JSON Line entries in a dataset. A JSON Line includes information about an image used for training or testing an Amazon Lookout for Vision model. To update an existing JSON Line, use the source-ref field to identify the JSON Line. The JSON line that you supply replaces the existing JSON line. Any existing annotations that are not in the new JSON line are removed from the dataset. For more information, see Defining JSON lines for anomaly classification in the Amazon Lookout for Vision Developer Guide. The images you reference in the source-ref field of a JSON line, must be in the same S3 bucket as the existing images in the dataset. Updating a dataset might take a while to complete. To check the current status, call DescribeDataset and check the Status field in the response. This operation requires permissions to perform the lookoutvision:UpdateDatasetEntries operation. operationId: amazonWebServicesUpdateDatasetEntries tags: - 2020 11 20 /2020-11-20/projects/{projectName}/modelpackagingjobs: POST: summary: Amazon Web Services Startmodelpackagingjob description: 'Starts an Amazon Lookout for Vision model packaging job. A model packaging job creates an AWS IoT Greengrass component for a Lookout for Vision model. You can use the component to deploy your model to an edge device managed by Greengrass. Use the DescribeModelPackagingJob API to determine the current status of the job. The model packaging job is complete if the value of Status is SUCCEEDED. To deploy the component to the target device, use the component name and component version with the AWS IoT Greengrass CreateDeployment API. This operation requires the following permissions: lookoutvision:StartModelPackagingJob s3:PutObject s3:GetBucketLocation kms:GenerateDataKey greengrass:CreateComponentVersion greengrass:DescribeComponent (Optional) greengrass:TagResource. Only required if you want to tag the component. For more information, see Using your Amazon Lookout for Vision model on an edge device in the Amazon Lookout for Vision Developer Guide. ' operationId: amazonWebServicesStartModelPackagingJob tags: - 2020 11 20 /2020-11-20/tags/{resourceArn}: DELETE: summary: Amazon Web Services Untagresource description: Removes one or more tags from an Amazon Lookout for Vision model. For more information, see Tagging a model in the Amazon Lookout for Vision Developer Guide. This operation requires permissions to perform the lookoutvision:UntagResource operation. operationId: amazonWebServicesUntagResource tags: - 2020 11 20 /2020-11-20/projects/{projectName}/models/{modelVersion}/start: POST: summary: Amazon Web Services Startmodel description: Starts the running of the version of an Amazon Lookout for Vision model. Starting a model takes a while to complete. To check the current state of the model, use DescribeModel. A model is ready to use when its status is HOSTED. Once the model is running, you can detect custom labels in new images by calling DetectAnomalies. You are charged for the amount of time that the model is running. To stop a running model, call StopModel. This operation requires permissions to perform the lookoutvision:StartModel operation. operationId: amazonWebServicesStartModel tags: - 2020 11 20 /2020-11-20/projects/{projectName}/models/{modelVersion}/stop: POST: summary: Amazon Web Services Stopmodel description: Stops the hosting of a running model. The operation might take a while to complete. To check the current status, call DescribeModel. After the model hosting stops, the Status of the model is TRAINED. This operation requires permissions to perform the lookoutvision:StopModel operation. operationId: amazonWebServicesStopModel tags: - 2020 11 20