IAM Access Analyzer guides you toward least privilege by providing tools to set, verify, and refine permissions. IAM Access Analyzer provides access analysis, policy checks, and policy generation.
 
When you enable IAM Access Analyzer, you create an analyzer, which is a resource that continuously evaluates your accounts or AWS organization for either external access or unused access. An analyzer generates access findings for your IAM roles, IAM users, and AWS resources. An external access analyzer creates public and cross-account access findings for resources, and is provided at no additional charge. An unused access analyzer is a paid feature that simplifies inspecting unused access to guide you toward least privilege. With this feature, you pay per IAM role or IAM user analyzed per analyzer per Region per month. IAM roles and users are global, so you can create an analyzer to cover multiple regions.

IAM Access Analyzer also offers two types of policy checks. IAM Access Analyzer policy validation guides you to author and validate secure and functional policies based on IAM best practices, and is provided at no additional charge. IAM Access Analyzer custom policy checks are a paid feature to validate that developer-authored policies adhere to your specified security standards ahead of deployments. Custom policy checks use the power of automated reasoning—provable security assurance backed by mathematical proof— so that security teams to proactively detect nonconformant updates to policies. For custom policy checks, you are charged based on the number of checks you run by calling the IAM Access Analyzer APIs.

IAM Access Analyzer policy generation creates a fine-grained policy based on the access activity captured in your logs and is provided at no additional charge.