Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.
External access analyzers help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.
Unused access analyzers help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.
Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs.
This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see Identity and Access Management Access Analyzer in the IAM User Guide.
tags: - name: Knowledgebases paths: /knowledgebases/{knowledgeBaseId}/datasources/: POST: summary: Amazon Web Services Listdatasources description: List data sources operationId: amazonWebServicesListDataSources tags: - Knowledgebases /knowledgebases/: POST: summary: Amazon Web Services Listknowledgebases description: List Knowledge Bases operationId: amazonWebServicesListKnowledgeBases tags: - Knowledgebases /knowledgebases/{knowledgeBaseId}/datasources/{dataSourceId}: PUT: summary: Amazon Web Services Updatedatasource description: Update an existing data source operationId: amazonWebServicesUpdateDataSource tags: - Knowledgebases /knowledgebases/{knowledgeBaseId}: PUT: summary: Amazon Web Services Updateknowledgebase description: Update an existing knowledge base operationId: amazonWebServicesUpdateKnowledgeBase tags: - Knowledgebases /knowledgebases/{knowledgeBaseId}/datasources/{dataSourceId}/ingestionjobs/{ingestionJobId}: GET: summary: Amazon Web Services Getingestionjob description: Get an ingestion job operationId: amazonWebServicesGetIngestionJob tags: - Knowledgebases /knowledgebases/{knowledgeBaseId}/datasources/{dataSourceId}/ingestionjobs/: PUT: summary: Amazon Web Services Startingestionjob description: Start a new ingestion job operationId: amazonWebServicesStartIngestionJob tags: - Knowledgebases /knowledgebases/{knowledgeBaseId}/retrieve: POST: summary: Amazon Web Services Retrieve description: Retrieve from knowledge base. operationId: amazonWebServicesRetrieve tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/contents: GET: summary: Amazon Web Services Listcontents description: Lists the content. operationId: amazonWebServicesListContents tags: - Knowledgebases /knowledgeBases: GET: summary: Amazon Web Services Listknowledgebases description: Lists the knowledge bases. operationId: amazonWebServicesListKnowledgeBases tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/quickResponses: GET: summary: Amazon Web Services Listquickresponses description: Lists information about quick response. operationId: amazonWebServicesListQuickResponses tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/contents/{contentId}: POST: summary: Amazon Web Services Updatecontent description: Updates information about the content. operationId: amazonWebServicesUpdateContent tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/importJobs/{importJobId}: GET: summary: Amazon Web Services Getimportjob description: Retrieves the started import job. operationId: amazonWebServicesGetImportJob tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}: GET: summary: Amazon Web Services Getknowledgebase description: Retrieves information about the knowledge base. operationId: amazonWebServicesGetKnowledgeBase tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/quickResponses/{quickResponseId}: POST: summary: Amazon Web Services Updatequickresponse description: Updates an existing Amazon Q quick response. operationId: amazonWebServicesUpdateQuickResponse tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/contents/{contentId}/summary: GET: summary: Amazon Web Services Getcontentsummary description: Retrieves summary information about the content. operationId: amazonWebServicesGetContentSummary tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/importJobs: POST: summary: Amazon Web Services Startimportjob description: 'Start an asynchronous job to import Amazon Q resources from an uploaded source file. Before calling this API, use StartContentUpload to upload an asset that contains the resource data. For importing Amazon Q quick responses, you need to upload a csv file including the quick responses. For information about how to format the csv file for importing quick responses, see Import quick responses. ' operationId: amazonWebServicesStartImportJob tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/templateUri: POST: summary: Amazon Web Services Updateknowledgebasetemplateuri description: 'Updates the template URI of a knowledge base. This is only supported for knowledge bases of type EXTERNAL. Include a single variable in ${variable} format; this interpolated by Amazon Q using ingested content. For example, if you ingest a Salesforce article, it has an Id value, and you can set the template URI to https://myInstanceName.lightning.force.com/lightning/r/Knowledge__kav/*${Id}*/view. ' operationId: amazonWebServicesUpdateKnowledgeBaseTemplateUri tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/search: POST: summary: Amazon Web Services Searchcontent description: Searches for content in a specified knowledge base. Can be used to get a specific content resource by its name. operationId: amazonWebServicesSearchContent tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/search/quickResponses: POST: summary: Amazon Web Services Searchquickresponses description: Searches existing Amazon Q quick responses in an Amazon Q knowledge base. operationId: amazonWebServicesSearchQuickResponses tags: - Knowledgebases /knowledgeBases/{knowledgeBaseId}/upload: POST: summary: Amazon Web Services Startcontentupload description: Get a URL to upload content to a knowledge base. To upload content, first make a PUT request to the returned URL with your file, making sure to include the required headers. Then use CreateContent to finalize the content creation process or UpdateContent to modify an existing resource. You can only upload content to a knowledge base of type CUSTOM. operationId: amazonWebServicesStartContentUpload tags: - Knowledgebases