IAM Access Analyzer

AWS IAM Access Analyzer uses automated reasoning to analyze resource-based policies and identify resources shared with external principals (outside the account or AWS organization), generating findings for unintended access. It can validate IAM policies against security best practices before deployment, check policies for syntax errors, and generate least-privilege policies based on CloudTrail access activity.

Access Analyzer is a key tool for detecting and preventing unintended public access to S3 buckets, KMS keys, and other resources.