AWS Identity and Access Management (IAM) Access Analyzer guides you toward least privilege by providing tools to set, verify, and refine permissions. IAM Access Analyzer provides access analysis findings, policy checks, and policy generation.

When you enable IAM Access Analyzer, you create an analyzer, which regularly checks your accounts or AWS organization for external access, internal access, and unused access. The analyzer generates access findings for your IAM roles, IAM users, and AWS resources. You can enable three types of analyzers: external access analyzer, internal access analyzer, and unused access analyzer:

• An external access analyzer creates public and cross-account access findings for AWS resources. This is provided at no additional charge.
• An internal access analyzer identifies the IAM roles and users within your AWS organization that have access to your business-critical AWS resources. This is a paid feature. For every internal analyzer you enable, you pay per resource monitored per Region per month.
• An unused access analyzer inspects unused access to guide you toward least privilege. This is a paid feature. For every unused access analyzer you enable, you pay per IAM role or IAM user per month. Because IAM roles and users are global, you need to enable only one analyzer across all Regions in a partition.

Internal access analyzer and unused access analyzer charges occur once during setup, and then monthly on the first day of the month.

IAM Access Analyzer also offers two types of policy checks:

• IAM Access Analyzer policy validation guides you to author and validate secure and functional policies based on IAM best practices. This is provided at no additional charge.
• IAM Access Analyzer custom policy checks validate before deployment that developer-authored policies adhere to your specified security standards. This is a paid feature. Custom policy checks use automated reasoning—provable security assurance backed by mathematical proof—so that security teams can proactively detect nonconformant updates to policies. For custom policy checks, you are charged based on the number of checks you run by calling the IAM Access Analyzer APIs.

IAM Access Analyzer policy generation creates fine-grained policies based on the access activity captured in your logs. This is provided at no additional charge.