AWS IAM Access Analyzer Tutorial Demonstrates Reviewing Internal Resource Access

Summary

The tutorial shows how to configure IAM Access Analyzer for internal access and identify principals with permissions to selected AWS resources, including an S3 bucket. The demo highlights how findings can reveal broad access.

Key points

• The demo configures an internal access analyzer for selected resources in an AWS account, with analysis scoped by region and zone of trust.
• Findings identify principals and access levels for a test S3 bucket, including permissions such as creating or deleting resources.
• The presenter highlights that an EC2 role has broad permissions on the bucket, illustrating how unintended access can be discovered.
• The tutorial explains that access may arise from policies, roles, users, and other controls, which the analyzer evaluates instead of requiring manual review.
• Resources can be added by account selection, Amazon Resource Name, or CSV; the presenter notes that the service is paid.