Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.
External access analyzers help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.
Unused access analyzers help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.
Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs.
This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see Identity and Access Management Access Analyzer in the IAM User Guide.
tags: - name: Prod paths: /prod/inputDevices/{inputDeviceId}/accept: POST: summary: Amazon Web Services Acceptinputdevicetransfer description: Accept an incoming input device transfer. The ownership of the device will transfer to your AWS account. operationId: amazonWebServicesAcceptInputDeviceTransfer tags: - Prod /prod/batch/delete: POST: summary: Amazon Web Services Batchdelete description: Starts delete of resources. operationId: amazonWebServicesBatchDelete tags: - Prod /prod/batch/start: POST: summary: Amazon Web Services Batchstart description: Starts existing resources operationId: amazonWebServicesBatchStart tags: - Prod /prod/batch/stop: POST: summary: Amazon Web Services Batchstop description: Stops running resources operationId: amazonWebServicesBatchStop tags: - Prod /prod/channels/{channelId}/schedule: GET: summary: Amazon Web Services Describeschedule description: Get a channel schedule operationId: amazonWebServicesDescribeSchedule tags: - Prod /prod/inputDevices/{inputDeviceId}/cancel: POST: summary: Amazon Web Services Cancelinputdevicetransfer description: Cancel an input device transfer that you have requested. operationId: amazonWebServicesCancelInputDeviceTransfer tags: - Prod /prod/claimDevice: POST: summary: Amazon Web Services Claimdevice description: Send a request to claim an AWS Elemental device that you have purchased from a third-party vendor. After the request succeeds, you will own the device. operationId: amazonWebServicesClaimDevice tags: - Prod /prod/channels: GET: summary: Amazon Web Services Listchannels description: Produces list of channels that have been created operationId: amazonWebServicesListChannels tags: - Prod /prod/inputs: GET: summary: Amazon Web Services Listinputs description: Produces list of inputs that have been created operationId: amazonWebServicesListInputs tags: - Prod /prod/inputSecurityGroups: GET: summary: Amazon Web Services Listinputsecuritygroups description: Produces a list of Input Security Groups for an account operationId: amazonWebServicesListInputSecurityGroups tags: - Prod /prod/multiplexes: GET: summary: Amazon Web Services Listmultiplexes description: Retrieve a list of the existing multiplexes. operationId: amazonWebServicesListMultiplexes tags: - Prod /prod/multiplexes/{multiplexId}/programs: GET: summary: Amazon Web Services Listmultiplexprograms description: List the programs that currently exist for a specific multiplex. operationId: amazonWebServicesListMultiplexPrograms tags: - Prod /prod/inputs/{inputId}/partners: POST: summary: Amazon Web Services Createpartnerinput description: Create a partner input operationId: amazonWebServicesCreatePartnerInput tags: - Prod /prod/tags/{resource-arn}: GET: summary: Amazon Web Services Listtagsforresource description: Produces list of tags that have been created for a resource operationId: amazonWebServicesListTagsForResource tags: - Prod /prod/channels/{channelId}: PUT: summary: Amazon Web Services Updatechannel description: Updates a channel. operationId: amazonWebServicesUpdateChannel tags: - Prod /prod/inputs/{inputId}: PUT: summary: Amazon Web Services Updateinput description: Updates an input. operationId: amazonWebServicesUpdateInput tags: - Prod /prod/inputSecurityGroups/{inputSecurityGroupId}: PUT: summary: Amazon Web Services Updateinputsecuritygroup description: Update an Input Security Group's Whilelists. operationId: amazonWebServicesUpdateInputSecurityGroup tags: - Prod /prod/multiplexes/{multiplexId}: PUT: summary: Amazon Web Services Updatemultiplex description: Updates a multiplex. operationId: amazonWebServicesUpdateMultiplex tags: - Prod /prod/multiplexes/{multiplexId}/programs/{programName}: PUT: summary: Amazon Web Services Updatemultiplexprogram description: Update a program in a multiplex. operationId: amazonWebServicesUpdateMultiplexProgram tags: - Prod /prod/reservations/{reservationId}: PUT: summary: Amazon Web Services Updatereservation description: Update reservation. operationId: amazonWebServicesUpdateReservation tags: - Prod /prod/accountConfiguration: PUT: summary: Amazon Web Services Updateaccountconfiguration description: Update account configuration operationId: amazonWebServicesUpdateAccountConfiguration tags: - Prod /prod/inputDevices/{inputDeviceId}: PUT: summary: Amazon Web Services Updateinputdevice description: Updates the parameters for the input device. operationId: amazonWebServicesUpdateInputDevice tags: - Prod /prod/inputDevices/{inputDeviceId}/thumbnailData: GET: summary: Amazon Web Services Describeinputdevicethumbnail description: Get the latest thumbnail data for the input device. operationId: amazonWebServicesDescribeInputDeviceThumbnail tags: - Prod /prod/offerings/{offeringId}: GET: summary: Amazon Web Services Describeoffering description: Get details for an offering. operationId: amazonWebServicesDescribeOffering tags: - Prod /prod/channels/{channelId}/thumbnails: GET: summary: Amazon Web Services Describethumbnails description: Describe the latest thumbnails data. operationId: amazonWebServicesDescribeThumbnails tags: - Prod /prod/inputDeviceTransfers: GET: summary: Amazon Web Services Listinputdevicetransfers description: List input devices that are currently being transferred. List input devices that you are transferring from your AWS account or input devices that another AWS account is transferring to you. operationId: amazonWebServicesListInputDeviceTransfers tags: - Prod /prod/inputDevices: GET: summary: Amazon Web Services Listinputdevices description: List input devices operationId: amazonWebServicesListInputDevices tags: - Prod /prod/offerings: GET: summary: Amazon Web Services Listofferings description: List offerings available for purchase. operationId: amazonWebServicesListOfferings tags: - Prod /prod/reservations: GET: summary: Amazon Web Services Listreservations description: List purchased reservations. operationId: amazonWebServicesListReservations tags: - Prod /prod/offerings/{offeringId}/purchase: POST: summary: Amazon Web Services Purchaseoffering description: Purchase an offering and create a reservation. operationId: amazonWebServicesPurchaseOffering tags: - Prod /prod/inputDevices/{inputDeviceId}/reboot: POST: summary: Amazon Web Services Rebootinputdevice description: Send a reboot command to the specified input device. The device will begin rebooting within a few seconds of sending the command. When the reboot is complete, the device’s connection status will change to connected. operationId: amazonWebServicesRebootInputDevice tags: - Prod /prod/inputDevices/{inputDeviceId}/reject: POST: summary: Amazon Web Services Rejectinputdevicetransfer description: Reject the transfer of the specified input device to your AWS account. operationId: amazonWebServicesRejectInputDeviceTransfer tags: - Prod /prod/channels/{channelId}/start: POST: summary: Amazon Web Services Startchannel description: Starts an existing channel operationId: amazonWebServicesStartChannel tags: - Prod /prod/inputDevices/{inputDeviceId}/start: POST: summary: Amazon Web Services Startinputdevice description: Start an input device that is attached to a MediaConnect flow. (There is no need to start a device that is attached to a MediaLive input; MediaLive starts the device when the channel starts.) operationId: amazonWebServicesStartInputDevice tags: - Prod /prod/inputDevices/{inputDeviceId}/startInputDeviceMaintenanceWindow: POST: summary: Amazon Web Services Startinputdevicemaintenancewindow description: Start a maintenance window for the specified input device. Starting a maintenance window will give the device up to two hours to install software. If the device was streaming prior to the maintenance, it will resume streaming when the software is fully installed. Devices automatically install updates while they are powered on and their MediaLive channels are stopped. A maintenance window allows you to update a device without having to stop MediaLive channels that use the device. The device must remain powered on and connected to the internet for the duration of the maintenance. operationId: amazonWebServicesStartInputDeviceMaintenanceWindow tags: - Prod /prod/multiplexes/{multiplexId}/start: POST: summary: Amazon Web Services Startmultiplex description: Start (run) the multiplex. Starting the multiplex does not start the channels. You must explicitly start each channel. operationId: amazonWebServicesStartMultiplex tags: - Prod /prod/channels/{channelId}/stop: POST: summary: Amazon Web Services Stopchannel description: Stops a running channel operationId: amazonWebServicesStopChannel tags: - Prod /prod/inputDevices/{inputDeviceId}/stop: POST: summary: Amazon Web Services Stopinputdevice description: Stop an input device that is attached to a MediaConnect flow. (There is no need to stop a device that is attached to a MediaLive input; MediaLive automatically stops the device when the channel stops.) operationId: amazonWebServicesStopInputDevice tags: - Prod /prod/multiplexes/{multiplexId}/stop: POST: summary: Amazon Web Services Stopmultiplex description: Stops a running multiplex. If the multiplex isn't running, this action has no effect. operationId: amazonWebServicesStopMultiplex tags: - Prod /prod/inputDevices/{inputDeviceId}/transfer: POST: summary: Amazon Web Services Transferinputdevice description: Start an input device transfer to another AWS account. After you make the request, the other account must accept or reject the transfer. operationId: amazonWebServicesTransferInputDevice tags: - Prod /prod/channels/{channelId}/channelClass: PUT: summary: Amazon Web Services Updatechannelclass description: Changes the class of the channel. operationId: amazonWebServicesUpdateChannelClass tags: - Prod