AWS.AccessAnalyzer reference

Analyzer

Source: src/AWS/AccessAnalyzer/Analyzer.ts

An AWS IAM Access Analyzer — continuously monitors resource policies to identify resources shared with an external entity (external-access analyzers) or unused IAM access (unused-access analyzers).

The ACCOUNT external-access analyzer is free and is the common case: create one per account per Region to have Access Analyzer surface public and cross-account grants as findings.

Analyzer: Creating an Analyzer

Account External-Access Analyzer

import * as AWS from "alchemy/AWS";

const analyzer = yield* AWS.AccessAnalyzer.Analyzer("AccountAnalyzer", {
  type: "ACCOUNT",
});

Analyzer with Tags

const analyzer = yield* AWS.AccessAnalyzer.Analyzer("AccountAnalyzer", {
  analyzerName: "prod-external-access",
  type: "ACCOUNT",
  tags: { Environment: "prod" },
});

Unused-Access Analyzer with a Custom Tracking Period

const analyzer = yield* AWS.AccessAnalyzer.Analyzer("UnusedAccess", {
  type: "ACCOUNT_UNUSED_ACCESS",
  unusedAccessAge: "180 days",
});

Analyzer: Archiving Findings

const analyzer = yield* AWS.AccessAnalyzer.Analyzer("AccountAnalyzer", {});

yield* AWS.AccessAnalyzer.ArchiveRule("TrustedAccount", {
  analyzerName: analyzer.analyzerName,
  ruleName: "trusted-account",
  filter: {
    "principal.AWS": { eq: ["123456789012"] },
  },
});

ApplyArchiveRule

Source: src/AWS/AccessAnalyzer/ApplyArchiveRule.ts

Runtime binding for access-analyzer:ApplyArchiveRule.

Retroactively applies an archive rule to the analyzer’s existing findings. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.ApplyArchiveRuleHttp).

ApplyArchiveRule: Managing Findings

const applyRule = yield* AWS.AccessAnalyzer.ApplyArchiveRule(analyzer);
yield* applyRule({ ruleName: rule.ruleName });

ArchiveRule

Source: src/AWS/AccessAnalyzer/ArchiveRule.ts

An archive rule for an IAM Access Analyzer — automatically archives new findings that match the filter criteria, so expected cross-account or public grants don’t clutter the active findings list.

Archive rules apply only to findings created after the rule; existing findings are unaffected.

ArchiveRule: Creating Archive Rules

Archive Findings from a Trusted Account

import * as AWS from "alchemy/AWS";

const analyzer = yield* AWS.AccessAnalyzer.Analyzer("AccountAnalyzer", {});

yield* AWS.AccessAnalyzer.ArchiveRule("TrustedAccount", {
  analyzerName: analyzer.analyzerName,
  ruleName: "trusted-account",
  filter: {
    "principal.AWS": { eq: ["123456789012"] },
  },
});

Archive Public S3 Findings

yield* AWS.AccessAnalyzer.ArchiveRule("PublicBuckets", {
  analyzerName: analyzer.analyzerName,
  ruleName: "public-buckets",
  filter: {
    resourceType: { eq: ["AWS::S3::Bucket"] },
    isPublic: { eq: ["true"] },
  },
});

CancelPolicyGeneration

Source: src/AWS/AccessAnalyzer/CancelPolicyGeneration.ts

Runtime binding for access-analyzer:CancelPolicyGeneration.

Cancels an in-progress policy-generation job. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.CancelPolicyGenerationHttp).

CancelPolicyGeneration: Policy Generation

const cancelGeneration =
  yield* AWS.AccessAnalyzer.CancelPolicyGeneration();
yield* cancelGeneration({ jobId });

CheckAccessNotGranted

Source: src/AWS/AccessAnalyzer/CheckAccessNotGranted.ts

Runtime binding for access-analyzer:CheckAccessNotGranted.

Custom policy check: verifies a policy does not grant the specified actions or resource access. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.CheckAccessNotGrantedHttp).

CheckAccessNotGranted: Custom Policy Checks

const checkAccessNotGranted =
  yield* AWS.AccessAnalyzer.CheckAccessNotGranted();
const result = yield* checkAccessNotGranted({
  policyDocument: JSON.stringify(policy),
  policyType: "IDENTITY_POLICY",
  access: [{ actions: ["s3:DeleteBucket"] }],
});
// result.result === "PASS" | "FAIL"

CheckNoNewAccess

Source: src/AWS/AccessAnalyzer/CheckNoNewAccess.ts

Runtime binding for access-analyzer:CheckNoNewAccess.

Custom policy check: verifies an updated policy grants no access beyond what the existing policy allows. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.CheckNoNewAccessHttp).

CheckNoNewAccess: Custom Policy Checks

const checkNoNewAccess = yield* AWS.AccessAnalyzer.CheckNoNewAccess();
const result = yield* checkNoNewAccess({
  existingPolicyDocument: JSON.stringify(existing),
  newPolicyDocument: JSON.stringify(proposed),
  policyType: "IDENTITY_POLICY",
});

CheckNoPublicAccess

Source: src/AWS/AccessAnalyzer/CheckNoPublicAccess.ts

Runtime binding for access-analyzer:CheckNoPublicAccess.

Custom policy check: verifies a resource policy cannot grant public access for the given resource type. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.CheckNoPublicAccessHttp).

CheckNoPublicAccess: Custom Policy Checks

const checkNoPublicAccess =
  yield* AWS.AccessAnalyzer.CheckNoPublicAccess();
const result = yield* checkNoPublicAccess({
  policyDocument: JSON.stringify(bucketPolicy),
  resourceType: "AWS::S3::Bucket",
});

CreateAccessPreview

Source: src/AWS/AccessAnalyzer/CreateAccessPreview.ts

Runtime binding for access-analyzer:CreateAccessPreview.

Previews the findings a proposed resource policy would generate, before deploying the policy. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.CreateAccessPreviewHttp).

CreateAccessPreview: Access Previews

const createPreview =
  yield* AWS.AccessAnalyzer.CreateAccessPreview(analyzer);
const preview = yield* createPreview({
  configurations: {
    [bucketArn]: { s3Bucket: { bucketPolicy: proposedPolicy } },
  },
});

GenerateFindingRecommendation

Source: src/AWS/AccessAnalyzer/GenerateFindingRecommendation.ts

Runtime binding for access-analyzer:GenerateFindingRecommendation.

Starts generating a remediation recommendation for an unused-permissions finding. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.GenerateFindingRecommendationHttp).

GenerateFindingRecommendation: Finding Recommendations

const generate =
  yield* AWS.AccessAnalyzer.GenerateFindingRecommendation(analyzer);
yield* generate({ id: findingId });

GetAccessPreview

Source: src/AWS/AccessAnalyzer/GetAccessPreview.ts

Runtime binding for access-analyzer:GetAccessPreview.

Retrieves an access preview’s status and configuration. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.GetAccessPreviewHttp).

GetAccessPreview: Access Previews

const getPreview = yield* AWS.AccessAnalyzer.GetAccessPreview(analyzer);
const preview = yield* getPreview({ accessPreviewId });

GetAnalyzedResource

Source: src/AWS/AccessAnalyzer/GetAnalyzedResource.ts

Runtime binding for access-analyzer:GetAnalyzedResource.

Retrieves the analysis status and sharing summary for a resource the analyzer has scanned. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.GetAnalyzedResourceHttp).

GetAnalyzedResource: Scanning Resources

const getResource =
  yield* AWS.AccessAnalyzer.GetAnalyzedResource(analyzer);
const analyzed = yield* getResource({ resourceArn: bucket.bucketArn });

GetFinding

Source: src/AWS/AccessAnalyzer/GetFinding.ts

Runtime binding for access-analyzer:GetFinding.

Retrieves a single external-access finding (V1 API — prefer GetFindingV2). Provide the implementation with Effect.provide(AWS.AccessAnalyzer.GetFindingHttp).

GetFinding: Reading Findings

const getFinding = yield* AWS.AccessAnalyzer.GetFinding(analyzer);
const result = yield* getFinding({ id: findingId });

GetFindingRecommendation

Source: src/AWS/AccessAnalyzer/GetFindingRecommendation.ts

Runtime binding for access-analyzer:GetFindingRecommendation.

Retrieves the generated remediation recommendation for an unused-permissions finding. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.GetFindingRecommendationHttp).

GetFindingRecommendation: Finding Recommendations

const getRecommendation =
  yield* AWS.AccessAnalyzer.GetFindingRecommendation(analyzer);
const recommendation = yield* getRecommendation({ id: findingId });

GetFindingsStatistics

Source: src/AWS/AccessAnalyzer/GetFindingsStatistics.ts

Runtime binding for access-analyzer:GetFindingsStatistics.

Retrieves aggregate finding statistics for the analyzer (counts by resource type or unused-access age). Provide the implementation with Effect.provide(AWS.AccessAnalyzer.GetFindingsStatisticsHttp).

GetFindingsStatistics: Reading Findings

const getStatistics =
  yield* AWS.AccessAnalyzer.GetFindingsStatistics(analyzer);
const stats = yield* getStatistics();

GetFindingV2

Source: src/AWS/AccessAnalyzer/GetFindingV2.ts

Runtime binding for the GetFindingV2 operation (IAM action access-analyzer:GetFinding — shared with the V1 API).

Retrieves a single finding with its typed findingDetails (external-access or unused-access). Provide the implementation with Effect.provide(AWS.AccessAnalyzer.GetFindingV2Http).

GetFindingV2: Reading Findings

const getFinding = yield* AWS.AccessAnalyzer.GetFindingV2(analyzer);
const finding = yield* getFinding({ id: findingId });

GetGeneratedPolicy

Source: src/AWS/AccessAnalyzer/GetGeneratedPolicy.ts

Runtime binding for access-analyzer:GetGeneratedPolicy.

Retrieves the status and result of a policy-generation job started with StartPolicyGeneration. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.GetGeneratedPolicyHttp).

GetGeneratedPolicy: Policy Generation

const getGenerated = yield* AWS.AccessAnalyzer.GetGeneratedPolicy();
const generated = yield* getGenerated({ jobId });

ListAccessPreviewFindings

Source: src/AWS/AccessAnalyzer/ListAccessPreviewFindings.ts

Runtime binding for access-analyzer:ListAccessPreviewFindings.

Lists the findings a completed access preview produced. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.ListAccessPreviewFindingsHttp).

ListAccessPreviewFindings: Access Previews

const listPreviewFindings =
  yield* AWS.AccessAnalyzer.ListAccessPreviewFindings(analyzer);
const page = yield* listPreviewFindings({ accessPreviewId });

ListAccessPreviews

Source: src/AWS/AccessAnalyzer/ListAccessPreviews.ts

Runtime binding for access-analyzer:ListAccessPreviews.

Lists the analyzer’s access previews. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.ListAccessPreviewsHttp).

ListAccessPreviews: Access Previews

const listPreviews =
  yield* AWS.AccessAnalyzer.ListAccessPreviews(analyzer);
const page = yield* listPreviews();

ListAnalyzedResources

Source: src/AWS/AccessAnalyzer/ListAnalyzedResources.ts

Runtime binding for access-analyzer:ListAnalyzedResources.

Lists the resources the analyzer has scanned, optionally filtered by resource type. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.ListAnalyzedResourcesHttp).

ListAnalyzedResources: Scanning Resources

const listResources =
  yield* AWS.AccessAnalyzer.ListAnalyzedResources(analyzer);
const page = yield* listResources({
  resourceType: "AWS::S3::Bucket",
});

ListFindings

Source: src/AWS/AccessAnalyzer/ListFindings.ts

Runtime binding for access-analyzer:ListFindings.

Lists the analyzer’s external-access findings (V1 API — prefer ListFindingsV2, which also returns unused-access findings). Provide the implementation with Effect.provide(AWS.AccessAnalyzer.ListFindingsHttp).

ListFindings: Reading Findings

const listFindings = yield* AWS.AccessAnalyzer.ListFindings(analyzer);
const page = yield* listFindings({ maxResults: 50 });

ListFindingsV2

Source: src/AWS/AccessAnalyzer/ListFindingsV2.ts

Runtime binding for the ListFindingsV2 operation (IAM action access-analyzer:ListFindings — shared with the V1 API).

Lists the analyzer’s findings (external-access and unused-access), with optional filter and sort criteria. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.ListFindingsV2Http).

ListFindingsV2: Reading Findings

// init — bind the operation to the analyzer
const listFindings = yield* AWS.AccessAnalyzer.ListFindingsV2(analyzer);

// runtime — page through active findings
const page = yield* listFindings({
  filter: { status: { eq: ["ACTIVE"] } },
  maxResults: 50,
});

ListPolicyGenerations

Source: src/AWS/AccessAnalyzer/ListPolicyGenerations.ts

Runtime binding for access-analyzer:ListPolicyGenerations.

Lists the account’s recent policy-generation jobs. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.ListPolicyGenerationsHttp).

ListPolicyGenerations: Policy Generation

const listGenerations =
  yield* AWS.AccessAnalyzer.ListPolicyGenerations();
const page = yield* listGenerations();

StartPolicyGeneration

Source: src/AWS/AccessAnalyzer/StartPolicyGeneration.ts

Runtime binding for access-analyzer:StartPolicyGeneration.

Starts generating a least-privilege policy for a principal from its access activity (optionally a CloudTrail trail). Provide the implementation with Effect.provide(AWS.AccessAnalyzer.StartPolicyGenerationHttp).

StartPolicyGeneration: Policy Generation

const startGeneration =
  yield* AWS.AccessAnalyzer.StartPolicyGeneration();
const { jobId } = yield* startGeneration({
  policyGenerationDetails: { principalArn: roleArn },
});

StartResourceScan

Source: src/AWS/AccessAnalyzer/StartResourceScan.ts

Runtime binding for access-analyzer:StartResourceScan.

Immediately rescans a resource’s policy instead of waiting for the analyzer’s periodic scan. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.StartResourceScanHttp).

StartResourceScan: Scanning Resources

const startScan = yield* AWS.AccessAnalyzer.StartResourceScan(analyzer);
yield* startScan({ resourceArn: bucket.bucketArn });

UpdateFindings

Source: src/AWS/AccessAnalyzer/UpdateFindings.ts

Runtime binding for access-analyzer:UpdateFindings.

Archives or reactivates findings by id or by the resource they were generated for. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.UpdateFindingsHttp).

UpdateFindings: Managing Findings

const updateFindings = yield* AWS.AccessAnalyzer.UpdateFindings(analyzer);
yield* updateFindings({ status: "ARCHIVED", ids: [findingId] });

ValidatePolicy

Source: src/AWS/AccessAnalyzer/ValidatePolicy.ts

Runtime binding for access-analyzer:ValidatePolicy.

Validates a policy document against IAM policy grammar and best practices, returning findings with fix suggestions. Provide the implementation with Effect.provide(AWS.AccessAnalyzer.ValidatePolicyHttp).

ValidatePolicy: Validating Policies

// init — account-level, no resource argument
const validatePolicy = yield* AWS.AccessAnalyzer.ValidatePolicy();

// runtime
const result = yield* validatePolicy({
  policyDocument: JSON.stringify(policy),
  policyType: "IDENTITY_POLICY",
});