IAM Access Analyzer helps identify resources in your account that give access to external entities by analyzing the policies attached to the resources it supports, such as SNS topics and Lambda functions. IAM Access Analyzer can also generate fine-grained policies based on the actions taken by an IAM entity.
In this CloudLab, you’ll first enable Access Analyzer for your account, create resources such as an S3 bucket, SNS topic, and a Lambda function, and then attach some overly permissive policies to them. Next, you will observe the findings generated by Access Analyzer and create archive rules based on them. You’ll also update the overly permissive policies created earlier and rescan the findings in Access Analyzer. Next, you’ll create an IAM user and attach an overly permissive policy. Further, you’ll use the newly created user to create an S3 bucket to generate some events in CloudTrail and use Access Analyzer to generate a fine-grained policy for your IAM user.
After completing this Cloud Lab, you’ll understand how IAM Access Analyzer works, create archive rules based on the findings provided by Access Analyzer, and generate policies for IAM entities using IAM Access Analyzer.
Following is a high-level architecture diagram for this Cloud Lab:
