AWS IAM least privilege with Access Analyzer

Generate tight IAM policies from real CloudTrail activity and find resources shared outside your account.

IAM least privilege is easy to say and hard to do because nobody knows which permissions a role actually uses. AWS gives you two tools that turn guesswork into evidence: Access Analyzer can generate a policy from CloudTrail history, and it flags any resource shared outside your account.

Generate a policy from real usage

Point Access Analyzer at a role's CloudTrail trail and it emits a policy containing only the actions that role actually called over the window — a tight starting point instead of *.

Find access that leaves your account

Tighten with conditions

{
  "Effect": "Allow",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::acme-app/*",
  "Condition": { "Bool": { "aws:SecureTransport": "true" } }
}

Related posts