Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.
External access analyzers help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.
Unused access analyzers help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.
Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs.
This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see Identity and Access Management Access Analyzer in the IAM User Guide.
tags: - name: Identitypools paths: /identitypools/{IdentityPoolId}/bulkpublish: POST: summary: Amazon Web Services Bulkpublish description: Initiates a bulk publish of all existing datasets for an Identity Pool to the configured stream. Customers are limited to one successful bulk publish per 24 hours. Bulk publish is an asynchronous request, customers can see the status of the request via the GetBulkPublishDetails operation.This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity. operationId: amazonWebServicesBulkPublish tags: - Identitypools /identitypools/{IdentityPoolId}/identities/{IdentityId}/datasets/{DatasetName}: POST: summary: Amazon Web Services Updaterecords description: Posts updates to records and adds and deletes records for a dataset and user. The sync count in the record patch is your last known sync count for that record. The server will reject an UpdateRecords request with a ResourceConflictException if you try to patch a record with a new value but a stale sync count.For example, if the sync count on the server is 5 for a key called highScore and you try and submit a new highScore with sync count of 4, the request will be rejected. To obtain the current sync count for a record, call ListRecords. On a successful update of the record, the response returns the new sync count for that record. You should present that sync count the next time you try to update that same record. When the record does not exist, specify the sync count as 0. This API can be called with temporary user credentials provided by Cognito Identity or with developer credentials. operationId: amazonWebServicesUpdateRecords tags: - Identitypools /identitypools/{IdentityPoolId}: GET: summary: Amazon Web Services Describeidentitypoolusage description: Gets usage details (for example, data storage) about a particular identity pool. This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity. operationId: amazonWebServicesDescribeIdentityPoolUsage tags: - Identitypools /identitypools/{IdentityPoolId}/identities/{IdentityId}: GET: summary: Amazon Web Services Describeidentityusage description: Gets usage information for an identity, including number of datasets and data usage. This API can be called with temporary user credentials provided by Cognito Identity or with developer credentials. operationId: amazonWebServicesDescribeIdentityUsage tags: - Identitypools /identitypools/{IdentityPoolId}/getBulkPublishDetails: POST: summary: Amazon Web Services Getbulkpublishdetails description: Get the status of the last BulkPublish operation for an identity pool.This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity. operationId: amazonWebServicesGetBulkPublishDetails tags: - Identitypools /identitypools/{IdentityPoolId}/events: POST: summary: Amazon Web Services Setcognitoevents description: Sets the AWS Lambda function for a given event type for an identity pool. This request only updates the key/value pair specified. Other key/values pairs are not updated. To remove a key value pair, pass a empty value for the particular key.This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity. operationId: amazonWebServicesSetCognitoEvents tags: - Identitypools /identitypools/{IdentityPoolId}/configuration: POST: summary: Amazon Web Services Setidentitypoolconfiguration description: Sets the necessary configuration for push sync.This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity. operationId: amazonWebServicesSetIdentityPoolConfiguration tags: - Identitypools /identitypools/{IdentityPoolId}/identities/{IdentityId}/datasets: GET: summary: Amazon Web Services Listdatasets description: Lists datasets for an identity. With Amazon Cognito Sync, each identity has access only to its own data. Thus, the credentials used to make this API call need to have access to the identity data. ListDatasets can be called with temporary user credentials provided by Cognito Identity or with developer credentials. You should use the Cognito Identity credentials to make this API call. operationId: amazonWebServicesListDatasets tags: - Identitypools /identitypools: GET: summary: Amazon Web Services Listidentitypoolusage description: Gets a list of identity pools registered with Cognito. ListIdentityPoolUsage can only be called with developer credentials. You cannot make this API call with the temporary user credentials provided by Cognito Identity. operationId: amazonWebServicesListIdentityPoolUsage tags: - Identitypools /identitypools/{IdentityPoolId}/identities/{IdentityId}/datasets/{DatasetName}/records: GET: summary: Amazon Web Services Listrecords description: Gets paginated records, optionally changed after a particular sync count for a dataset and identity. With Amazon Cognito Sync, each identity has access only to its own data. Thus, the credentials used to make this API call need to have access to the identity data. ListRecords can be called with temporary user credentials provided by Cognito Identity or with developer credentials. You should use Cognito Identity credentials to make this API call. operationId: amazonWebServicesListRecords tags: - Identitypools /identitypools/{IdentityPoolId}/identity/{IdentityId}/device: POST: summary: Amazon Web Services Registerdevice description: Registers a device to receive push sync notifications.This API can only be called with temporary credentials provided by Cognito Identity. You cannot call this API with developer credentials. operationId: amazonWebServicesRegisterDevice tags: - Identitypools /identitypools/{IdentityPoolId}/identities/{IdentityId}/datasets/{DatasetName}/subscriptions/{DeviceId}: DELETE: summary: Amazon Web Services Unsubscribefromdataset description: Unsubscribes from receiving notifications when a dataset is modified by another device.This API can only be called with temporary credentials provided by Cognito Identity. You cannot call this API with developer credentials. operationId: amazonWebServicesUnsubscribeFromDataset tags: - Identitypools