All checks
High
IAM Access Analyzer external access analyzer should be enabled
Confirms that each Region has an active IAM Access Analyzer external access analyzer, which flags resources such as S3 buckets and IAM roles shared outside your zone of trust. Analyzers are Regional and do not cover each other; one still creating, failed or disabled does not count, and neither do unused access or internal access analyzers.
- service
- IAM
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
IAM → Access analyzer → Analyzer settings → Create analyzer, in the Region the finding names
With the AWS CLI
aws accessanalyzer create-analyzer --analyzer-name <analyzer-name> --type ACCOUNT --region <region>With Terraform
resource "aws_accessanalyzer_analyzer" "this" {
analyzer_name = var.analyzer_name
type = "ACCOUNT"
}See which of your accounts this check is failing on.
Book a demo