AWS IAM Access Analyzer

AWS IAM Access Analyzer helps teams review and refine permissions on the path to least privilege. It identifies external, internal, and unused access to AWS resources. External analysis watches for new or changed permissions that allow public or cross-account access; internal findings identify users and roles with access to S3, DynamoDB, or RDS. Unused-access analysis can flag unused roles, IAM user keys and passwords, services, and actions. The service can generate fine-grained IAM policies from activity in CloudTrail logs, and policy validation returns security warnings, errors, and best-practice suggestions. Custom policy checks can be placed in CI/CD pipelines to review policies before deployment. It also provides last-accessed information for services and actions from selected AWS services, and integrates with AWS Security Hub CSPM and Amazon EventBridge for findings workflows. AWS says it uses automated reasoning, applying mathematical logic to assess permissions. Policy validation, policy generation, and external access analysis are provided at no additional charge; custom checks, unused-access analysis, and internal-access analysis have listed usage-based charges.

IAM Access Analyzer covers several permission-review tasks, including monitoring external access and identifying unused access. Check the listed usage charges for the specific analysis features you plan to use.

It suits security teams reviewing AWS permissions and compliance teams demonstrating access-control requirements. Teams can also use custom policy checks in a CI/CD review process.

Overview

AWS IAM Access Analyzer is an AWS permissions analysis service for teams responsible for securing cloud resources and demonstrating access-control compliance. It is best suited to organizations already managing AWS identities and resources; its focused access reviews are useful, but it is not a broad identity-management platform.

Key features

Find exposed, internal, and unused access

The external analyzer continuously checks for new or changed permissions that allow public or cross-account access. Internal findings identify users and roles with access to S3, DynamoDB, or RDS, while unused-access findings can surface dormant roles, IAM user credentials, services, and actions. Together, these checks help security teams focus reviews on exposure and permissions that may no longer be needed. Internal analysis is limited to those named resource types.

Last-accessed data for services and actions from select AWS services adds context to permission reviews, rather than a complete account of every access event. Automated reasoning applies mathematical logic to assess permissions, making the service useful for systematic review rather than relying only on manual inspection.

Policy tools and workflow integration

Access Analyzer can generate fine-grained IAM policies from activity recorded in CloudTrail logs. Policy validation returns security errors and warnings, general warnings, and IAM best-practice suggestions. Those tools support teams refining policies, though generated policies are based on observed activity and still need review before use.

Custom policy checks can be placed in CI/CD pipelines to evaluate policies before deployment. Security Hub CSPM and EventBridge integrations support findings analysis and notification workflows. These connections make the analyzer more useful as part of an AWS security process than as a standalone identity product.

Pricing

The core offer is free, but not every analyzer is included without charge. IAM policy validation, policy generation, and external access analysis each cost free, with no additional charge for those functions.

Custom policy checks show a price of free, but are billed at $0.0020 per API call. The monthly figure should not be mistaken for unlimited checks: cost depends on the number of API calls.

Unused access analysis costs $0.20 a month, billed at $0.20 per IAM role or IAM user per month. One analyzer covers all Regions in a partition because roles and users are global. Internal access analysis costs $9 a month, billed at $9.00 per monitored resource per Region per month, for monitoring business-critical resources within an AWS organization. Organizations should account for both resource count and Region coverage when estimating this charge.

This is a useful low-cost entry point for external exposure checks and policy validation, but teams needing unused or internal access analysis should budget for usage-based charges rather than assume the free plan covers the full feature set.

Platforms

Access Analyzer is a SaaS service for AWS, with web and API access as well as Android and iOS platform support. It supports policy simulation. Identity-related capabilities include SAML 2.0, OAuth 2.0, and OIDC, plus FIDO2 authenticators, virtual authenticator apps, and RADIUS MFA; directory sync and lifecycle provisioning are supported. Adaptive access policies and adaptive access are not supported.

Who it's for

Security teams that need to review AWS access and compliance teams demonstrating access-control audit requirements are the clearest fit. It is especially relevant where teams want to monitor public or cross-account exposure, check selected internal-resource access, or add policy checks to deployment pipelines. Organizations seeking a general identity platform or adaptive access controls should look elsewhere.

Pros and cons

Pros

• Useful core checks are free: external access analysis, policy validation, and policy generation can support routine AWS permission work without an analyzer charge.
• Multiple stages of review: exposure findings, unused-access analysis, policy generation, and validation cover more than a single permissions check.
• Fits AWS workflows: CI/CD checks and Security Hub CSPM and EventBridge integrations can bring findings into existing review and notification processes.

Cons

• Costs grow for deeper analysis: unused-access charges scale by IAM role or user, while internal analysis scales by resource and Region.
• Internal coverage is selective: findings identify access to S3, DynamoDB, or RDS, not an unrestricted inventory of all resource types.
• Not a full identity suite: adaptive access and adaptive access policies are absent, and the service is specifically for AWS.

Alternatives

For adjacent identity and access needs, compare Identity and Access Management Software, Cloud Infrastructure Entitlement Management Software, and Single Sign-On Software.

• Descope is a freemium alternative with open-source SDKs; consider it when those SDKs matter to your implementation.
• Frontegg offers a free Pay as you go plan with 7,500 monthly active users and five enterprise connections, so it may suit teams seeking those identity capabilities on a free tier.
• FusionAuth has a free, self-hosted Community plan with unlimited use and core authentication features; choose it when self-hosting is central.
• Google Cloud Identity is an option for teams seeking its Premium annual plan, priced at $6 a month.
• miniOrange Identity and Access Management has a free Customer IAM plan and a free trial; consider it for customer identity needs.
• Stytch offers a free starting tier with 10,000 monthly active users and agents, unlimited organizations, and five SSO or SCIM connections.
• Auth0 Guardian offers a free plan capped at 25,000 monthly active users, one custom domain, five organizations, and one enterprise connection.
• Amazon Cognito provides 10,000 monthly active users free per month for eligible direct or social sign-ins, with pay-as-you-go rates above that threshold.

Verdict

Choose AWS IAM Access Analyzer if your team needs focused visibility into AWS permissions, especially public or cross-account exposure, and wants policy checks integrated into AWS workflows. Its free core features make it a practical starting point; look elsewhere if you need broad identity management, adaptive access, or internal analysis across resources beyond its named coverage.