AWS Identity and Access Management (IAM)

IAM Access Analyzer helps organizations achieve least privilege by analyzing permissions, identifying unused access, and validating IAM policies

Regularly review and adjust IAM Access Analyzer usage to align with changing organizational needs and maintain cost efficiency

Querying Costs: Use AWS Cost and Usage Reports (AWS CUR) with Amazon Athena to analyze IAM Access Analyzer usage and costs

Use AWS Budgets or AWS Cost Anomaly Detection to monitor unused access analysis expenses and set alerts for cost thresholds

Regular Cleanup: Periodically review and remove unused IAM roles and users to lower costs and improve security

Tagging for Exclusion: Use tags to exclude specific IAM roles or users from analysis, reducing costs and focusing on relevant resources

Consolidate unused analyzers to reduce costs by ensuring only one analyzer is active per account or organization

Suggests optimized IAM policies based on access behavior, helping to remove unnecessary roles, keys, and passwords

Policy Validation: Automates IAM policy reviews to ensure compliance with security standards and best practices

Cost Management: To avoid duplicate charges, use a single unused access analyzer per account or organization and avoid deleting and recreating analyzers