Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.
External access analyzers help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.
Unused access analyzers help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.
Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs.
This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see Identity and Access Management Access Analyzer in the IAM User Guide.
tags: - name: profilingGroups paths: /profilingGroups/{profilingGroupName}/notificationConfiguration: GET: summary: Amazon Web Services Getnotificationconfiguration description: Get the current configuration for anomaly notifications for a profiling group. operationId: amazonWebServicesGetNotificationConfiguration tags: - profilingGroups /profilingGroups/{profilingGroupName}/frames/-/metrics: POST: summary: Amazon Web Services Batchgetframemetricdata description: ' Returns the time series of values for a requested list of frame metrics from a time period.' operationId: amazonWebServicesBatchGetFrameMetricData tags: - profilingGroups /profilingGroups/{profilingGroupName}/configureAgent: POST: summary: Amazon Web Services Configureagent description: ' Used by profiler agents to report their current state and to receive remote configuration updates. For example, ConfigureAgent can be used to tell an agent whether to profile or not and for how long to return profiling data. ' operationId: amazonWebServicesConfigureAgent tags: - profilingGroups /profilingGroups: GET: summary: Amazon Web Services Listprofilinggroups description: ' Returns a list of profiling groups. The profiling groups are returned as ProfilingGroupDescription objects. ' operationId: amazonWebServicesListProfilingGroups tags: - profilingGroups /profilingGroups/{profilingGroupName}: PUT: summary: Amazon Web Services Updateprofilinggroup description: Updates a profiling group. operationId: amazonWebServicesUpdateProfilingGroup tags: - profilingGroups /profilingGroups/{profilingGroupName}/policy: GET: summary: Amazon Web Services Getpolicy description: ' Returns the JSON-formatted resource-based policy on a profiling group. ' operationId: amazonWebServicesGetPolicy tags: - profilingGroups /profilingGroups/{profilingGroupName}/profile: GET: summary: Amazon Web Services Getprofile description: ' Gets the aggregated profile of a profiling group for a specified time range. Amazon CodeGuru Profiler collects posted agent profiles for a profiling group into aggregated profiles. <note> <p> Because aggregated profiles expire over time <code>GetProfile</code> is not idempotent. </p> </note> <p> Specify the time range for the requested aggregated profile using 1 or 2 of the following parameters: <code>startTime</code>, <code>endTime</code>, <code>period</code>. The maximum time range allowed is 7 days. If you specify all 3 parameters, an exception is thrown. If you specify only <code>period</code>, the latest aggregated profile is returned. </p> <p> Aggregated profiles are available with aggregation periods of 5 minutes, 1 hour, and 1 day, aligned to UTC. The aggregation period of an aggregated profile determines how long it is retained. For more information, see <a href="https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_AggregatedProfileTime.html"> <code>AggregatedProfileTime</code> </a>. The aggregated profile''s aggregation period determines how long it is retained by CodeGuru Profiler. </p> <ul> <li> <p> If the aggregation period is 5 minutes, the aggregated profile is retained for 15 days. </p> </li> <li> <p> If the aggregation period is 1 hour, the aggregated profile is retained for 60 days. </p> </li> <li> <p> If the aggregation period is 1 day, the aggregated profile is retained for 3 years. </p> </li> </ul> <p>There are two use cases for calling <code>GetProfile</code>.</p> <ol> <li> <p> If you want to return an aggregated profile that already exists, use <a href="https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ListProfileTimes.html"> <code>ListProfileTimes</code> </a> to view the time ranges of existing aggregated profiles. Use them in a <code>GetProfile</code> request to return a specific, existing aggregated profile. </p> </li> <li> <p> If you want to return an aggregated profile for a time range that doesn''t align with an existing aggregated profile, then CodeGuru Profiler makes a best effort to combine existing aggregated profiles from the requested time range and return them as one aggregated profile. </p> <p> If aggregated profiles do not exist for the full time range requested, then aggregated profiles for a smaller time range are returned. For example, if the requested time range is from 00:00 to 00:20, and the existing aggregated profiles are from 00:15 and 00:25, then the aggregated profiles from 00:15 to 00:20 are returned. </p> </li> </ol> ' operationId: amazonWebServicesGetProfile tags: - profilingGroups /profilingGroups/{profilingGroupName}/profileTimes: GET: summary: Amazon Web Services Listprofiletimes description: Lists the start times of the available aggregated profiles of a profiling group for an aggregation period within the specified time range. operationId: amazonWebServicesListProfileTimes tags: - profilingGroups /profilingGroups/{profilingGroupName}/agentProfile: POST: summary: Amazon Web Services Postagentprofile description: ' Submits profiling data to an aggregated profile of a profiling group. To get an aggregated profile that is created with this profiling data, use GetProfile . ' operationId: amazonWebServicesPostAgentProfile tags: - profilingGroups /profilingGroups/{profilingGroupName}/policy/{actionGroup}: DELETE: summary: Amazon Web Services Removepermission description: ' Removes permissions from a profiling group''s resource-based policy that are provided using an action group. The one supported action group that can be removed is agentPermission which grants ConfigureAgent and PostAgent permissions. For more information, see Resource-based policies in CodeGuru Profiler in the Amazon CodeGuru Profiler User Guide, ConfigureAgent , and PostAgentProfile . ' operationId: amazonWebServicesRemovePermission tags: - profilingGroups /profilingGroups/{profilingGroupName}/notificationConfiguration/{channelId}: DELETE: summary: Amazon Web Services Removenotificationchannel description: Remove one anomaly notifications channel for a profiling group. operationId: amazonWebServicesRemoveNotificationChannel tags: - profilingGroups