Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.
External access analyzers help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.
Unused access analyzers help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.
Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs.
This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see Identity and Access Management Access Analyzer in the IAM User Guide.
tags: - name: Sol paths: /sol/nslcm/v1/ns_lcm_op_occs/{nsLcmOpOccId}/cancel: POST: summary: Amazon Web Services Cancelsolnetworkoperation description: Cancels a network operation. A network operation is any operation that is done to your network, such as network instance instantiation or termination. operationId: amazonWebServicesCancelSolNetworkOperation tags: - Sol /sol/vnfpkgm/v1/vnf_packages: GET: summary: Amazon Web Services Listsolfunctionpackages description: Lists information about function packages. A function package is a .zip file in CSAR (Cloud Service Archive) format that contains a network function (an ETSI standard telecommunication application) and function package descriptor that uses the TOSCA standard to describe how the network functions should run on your network. operationId: amazonWebServicesListSolFunctionPackages tags: - Sol /sol/nslcm/v1/ns_instances: GET: summary: Amazon Web Services Listsolnetworkinstances description: Lists your network instances. A network instance is a single network created in Amazon Web Services TNB that can be deployed and on which life-cycle operations (like terminate, update, and delete) can be performed. operationId: amazonWebServicesListSolNetworkInstances tags: - Sol /sol/nsd/v1/ns_descriptors: GET: summary: Amazon Web Services Listsolnetworkpackages description: Lists network packages. A network package is a .zip file in CSAR (Cloud Service Archive) format defines the function packages you want to deploy and the Amazon Web Services infrastructure you want to deploy them on. operationId: amazonWebServicesListSolNetworkPackages tags: - Sol /sol/vnfpkgm/v1/vnf_packages/{vnfPkgId}: PATCH: summary: Amazon Web Services Updatesolfunctionpackage description: Updates the operational state of function package. A function package is a .zip file in CSAR (Cloud Service Archive) format that contains a network function (an ETSI standard telecommunication application) and function package descriptor that uses the TOSCA standard to describe how the network functions should run on your network. operationId: amazonWebServicesUpdateSolFunctionPackage tags: - Sol /sol/nslcm/v1/ns_instances/{nsInstanceId}: GET: summary: Amazon Web Services Getsolnetworkinstance description: Gets the details of the network instance. A network instance is a single network created in Amazon Web Services TNB that can be deployed and on which life-cycle operations (like terminate, update, and delete) can be performed. operationId: amazonWebServicesGetSolNetworkInstance tags: - Sol /sol/nsd/v1/ns_descriptors/{nsdInfoId}: PATCH: summary: Amazon Web Services Updatesolnetworkpackage description: Updates the operational state of a network package. A network package is a .zip file in CSAR (Cloud Service Archive) format defines the function packages you want to deploy and the Amazon Web Services infrastructure you want to deploy them on. A network service descriptor is a .yaml file in a network package that uses the TOSCA standard to describe the network functions you want to deploy and the Amazon Web Services infrastructure you want to deploy the network functions on. operationId: amazonWebServicesUpdateSolNetworkPackage tags: - Sol /sol/vnflcm/v1/vnf_instances/{vnfInstanceId}: GET: summary: Amazon Web Services Getsolfunctioninstance description: Gets the details of a network function instance, including the instantation state and metadata from the function package descriptor in the network function package. A network function instance is a function in a function package . operationId: amazonWebServicesGetSolFunctionInstance tags: - Sol /sol/vnfpkgm/v1/vnf_packages/{vnfPkgId}/package_content: PUT: summary: Amazon Web Services Putsolfunctionpackagecontent description: Uploads the contents of a function package. A function package is a .zip file in CSAR (Cloud Service Archive) format that contains a network function (an ETSI standard telecommunication application) and function package descriptor that uses the TOSCA standard to describe how the network functions should run on your network. operationId: amazonWebServicesPutSolFunctionPackageContent tags: - Sol /sol/vnfpkgm/v1/vnf_packages/{vnfPkgId}/vnfd: GET: summary: Amazon Web Services Getsolfunctionpackagedescriptor description: Gets a function package descriptor in a function package. A function package descriptor is a .yaml file in a function package that uses the TOSCA standard to describe how the network function in the function package should run on your network. A function package is a .zip file in CSAR (Cloud Service Archive) format that contains a network function (an ETSI standard telecommunication application) and function package descriptor that uses the TOSCA standard to describe how the network functions should run on your network. operationId: amazonWebServicesGetSolFunctionPackageDescriptor tags: - Sol /sol/nslcm/v1/ns_lcm_op_occs/{nsLcmOpOccId}: GET: summary: Amazon Web Services Getsolnetworkoperation description: Gets the details of a network operation, including the tasks involved in the network operation and the status of the tasks. A network operation is any operation that is done to your network, such as network instance instantiation or termination. operationId: amazonWebServicesGetSolNetworkOperation tags: - Sol /sol/nsd/v1/ns_descriptors/{nsdInfoId}/nsd_content: PUT: summary: Amazon Web Services Putsolnetworkpackagecontent description: Uploads the contents of a network package. A network package is a .zip file in CSAR (Cloud Service Archive) format defines the function packages you want to deploy and the Amazon Web Services infrastructure you want to deploy them on. operationId: amazonWebServicesPutSolNetworkPackageContent tags: - Sol /sol/nsd/v1/ns_descriptors/{nsdInfoId}/nsd: GET: summary: Amazon Web Services Getsolnetworkpackagedescriptor description: Gets the content of the network service descriptor. A network service descriptor is a .yaml file in a network package that uses the TOSCA standard to describe the network functions you want to deploy and the Amazon Web Services infrastructure you want to deploy the network functions on. operationId: amazonWebServicesGetSolNetworkPackageDescriptor tags: - Sol /sol/nslcm/v1/ns_instances/{nsInstanceId}/instantiate: POST: summary: Amazon Web Services Instantiatesolnetworkinstance description: Instantiates a network instance. A network instance is a single network created in Amazon Web Services TNB that can be deployed and on which life-cycle operations (like terminate, update, and delete) can be performed. Before you can instantiate a network instance, you have to create a network instance. For more information, see CreateSolNetworkInstance. operationId: amazonWebServicesInstantiateSolNetworkInstance tags: - Sol /sol/vnflcm/v1/vnf_instances: GET: summary: Amazon Web Services Listsolfunctioninstances description: Lists network function instances. A network function instance is a function in a function package . operationId: amazonWebServicesListSolFunctionInstances tags: - Sol /sol/nslcm/v1/ns_lcm_op_occs: GET: summary: Amazon Web Services Listsolnetworkoperations description: Lists details for a network operation, including when the operation started and the status of the operation. A network operation is any operation that is done to your network, such as network instance instantiation or termination. operationId: amazonWebServicesListSolNetworkOperations tags: - Sol /sol/nslcm/v1/ns_instances/{nsInstanceId}/terminate: POST: summary: Amazon Web Services Terminatesolnetworkinstance description: Terminates a network instance. A network instance is a single network created in Amazon Web Services TNB that can be deployed and on which life-cycle operations (like terminate, update, and delete) can be performed. You must terminate a network instance before you can delete it. operationId: amazonWebServicesTerminateSolNetworkInstance tags: - Sol /sol/nslcm/v1/ns_instances/{nsInstanceId}/update: POST: summary: Amazon Web Services Updatesolnetworkinstance description: Update a network instance. A network instance is a single network created in Amazon Web Services TNB that can be deployed and on which life-cycle operations (like terminate, update, and delete) can be performed. operationId: amazonWebServicesUpdateSolNetworkInstance tags: - Sol /sol/vnfpkgm/v1/vnf_packages/{vnfPkgId}/package_content/validate: PUT: summary: Amazon Web Services Validatesolfunctionpackagecontent description: Validates function package content. This can be used as a dry run before uploading function package content with PutSolFunctionPackageContent. A function package is a .zip file in CSAR (Cloud Service Archive) format that contains a network function (an ETSI standard telecommunication application) and function package descriptor that uses the TOSCA standard to describe how the network functions should run on your network. operationId: amazonWebServicesValidateSolFunctionPackageContent tags: - Sol /sol/nsd/v1/ns_descriptors/{nsdInfoId}/nsd_content/validate: PUT: summary: Amazon Web Services Validatesolnetworkpackagecontent description: Validates network package content. This can be used as a dry run before uploading network package content with PutSolNetworkPackageContent. A network package is a .zip file in CSAR (Cloud Service Archive) format defines the function packages you want to deploy and the Amazon Web Services infrastructure you want to deploy them on. operationId: amazonWebServicesValidateSolNetworkPackageContent tags: - Sol