IAM Access Analyzer external access analyzer should be enabled
Description
This control checks whether an AWS account has an IAM Access Analyzer external access analyzer enabled. It fails if the account does not have an external access analyzer enabled in the currently selected AWS Region. IAM Access Analyzer external access analyzers help identify resources, such as Amazon Simple Storage Service (Amazon S3) buckets or IAM roles, that are shared with an external entity. This helps prevent unintended access to resources and data. IAM Access Analyzer is Regional and must be enabled in each Region. To identify resources shared with external principals, an access analyzer uses logic-based reasoning to analyze resource-based policies in the AWS environment. When creating an external access analyzer, it can be enabled for an entire organization or individual accounts.
Remediation
To remediate missing IAM Access Analyzer external access analyzer, you need to create and enable an external access analyzer in each AWS Region.
Steps
- Navigate to the AWS IAM Access Analyzer console
- Select the AWS Region where you want to enable the analyzer
- Click 'Create analyzer'
- Select 'External access analyzer' as the analyzer type
- Choose the scope (organization or individual account)
- Configure the analyzer settings
- Review and create the analyzer
- Verify the analyzer is active and running
- Repeat for all required AWS Regions
- Set up monitoring and alerting for analyzer findings