AWS IAM Access Analyzer Demo: Find External Access and Tighten Permissions

Summary

A hands-on demo shows how AWS IAM Access Analyzer can identify externally accessible resources, unused permissions, and policy needs based on CloudTrail activity, then help revoke access and reduce permissions.

Key points

• The demo shows an S3 bucket policy granting access to a separate AWS account; that account can list and download an object.
• Access Analyzer identifies external access findings, helping administrators review the external principal and revoke unintended access by changing the bucket policy.
• Unused access analysis surfaces roles, users, and permissions that have not been used during a selected period, supporting permission cleanup.
• The tutorial demonstrates generating an IAM policy from a role’s CloudTrail activity, then reviewing and editing the proposed actions before attaching it.
• The examples emphasize reducing permissions to match actual use rather than leaving broader access in place.