Least-privilege tooling and troubleshooting
IAM Access Analyzer external, internal and unused access findings, policy validation, generation and custom checks, the IAM policy simulator, last accessed data, and reading AccessDenied messages.
Exam tasks: 4.2 (Skills 4.2.3 least-privilege policies, 4.2.4 analyze authorization failures with the policy simulator and Access Analyzer, 4.2.5 investigate and correct unintended permissions), 4.1 (Skill 4.1.3 troubleshooting with CloudTrail)
The decision: is the problem too much access (find and remove it) or too little (find the layer that blocks it), and which tool answers that fastest?
Which tool
IAM Access Analyzer
| Capability | What it tells you | Scope | Cost |
|---|---|---|---|
| External access analyzer | Resources shared with principals outside your zone of trust (account or organization), including public | Per Region | Free |
| Internal access analyzer | Which principals inside the org or account can reach resources you select | Selected resources | Paid, per resource monitored |
| Unused access analyzer | Unused roles, access keys and passwords, and unused services and actions on used roles | Account or org, not per Region | Paid, per role or user analyzed |
| Policy validation | Grammar errors, security warnings, suggestions as you write a policy | Any policy | Free |
| Custom policy checks | CheckNoNewAccess (does this change widen access?), CheckAccessNotGranted (does it allow these critical actions or resources?), CheckNoPublicAccess | Any policy, in CI | Paid, per check |
| Policy generation | A draft policy built from the actions a role actually used in CloudTrail | One role or user | Free |
- Zone of trust: the account or organization you choose when creating the analyzer. Anything inside it is trusted and generates no external finding.
- External access covers S3 buckets and directory buckets, IAM role trust policies, KMS keys, Lambda functions and layers, SQS, SNS, Secrets Manager, EBS and RDS snapshots, ECR, EFS and DynamoDB tables and streams.
- Findings are active, archived (expected, often through archive rules for known partners) or resolved (the access is gone). Rescan after a fix instead of waiting for the periodic scan.
- Create an external access analyzer in every Region you use. Findings flow to Security Hub and EventBridge, covered in security findings hub.
- Preview access before you change a bucket or key policy: Access Analyzer shows the findings the new policy would create.
Exam signal
"Identify all resources shared with accounts outside the organization" means an external access analyzer with
the organization as the zone of trust, created from the delegated administrator. "Fail the pipeline if a policy
change grants new permissions" means custom policy checks (CheckNoNewAccess) in CI.
Access Analyzer as a preventive control
Access Analyzer finds and reports. It doesn't block a bad policy. If the question asks to prevent external sharing, the answer is an RCP, SCP or resource policy condition, with Access Analyzer as the detective partner.
Refining permissions
Start broad but bounded. An AWS managed or team policy, under a permissions boundary or SCP.
Observe. Run the workload through a full business cycle (month-end jobs included).
Generate. Use Access Analyzer policy generation over that period's CloudTrail trail, then add resource ARNs and conditions the generator can't know.
Validate and check. Run policy validation and CheckAccessNotGranted for actions that must never appear.
Keep trimming. Review unused access findings and last accessed data, and remove what stays unused.
Last accessed data
- Shows when an identity (or an OU or account, from the management account) last used each service, and for many services the last management action.
- Tracks at least 400 days. New activity can take up to 4 hours to appear.
- Covers only access granted by identity policies (or SCPs, for the Organizations view). Resource policies, data
events and
iam:PassRolearen't tracked. - Use it to shrink SCP allow lists and remove unused services from roles.
IAM policy simulator
- Tests identity policies, permissions boundaries, SCPs, and resource policies you provide, without making real calls.
- Principal mode tests an existing user, group or role. Custom mode tests a policy you paste in before attaching it.
- You supply condition values such as
aws:SourceIporaws:MultiFactorAuthPresent. It fills principal and organization keys such asaws:PrincipalOrgIDitself. - It doesn't evaluate RCPs, and results can differ from reality for VPC endpoint policies, role chaining and some cross-account setups. Confirm with a real test.
Reading an AccessDenied
Most services now say which policy type denied the call and whether it was explicit or implicit:
User: arn:aws:sts::404040404040:assumed-role/ledger-batch/job-7781 is not authorized to perform:
kms:Decrypt on resource: arn:aws:kms:eu-west-1:404040404040:key/9f1e...
with an explicit deny in a resource control policy| Phrase | Means | Look at |
|---|---|---|
| "with an explicit deny in a service control policy" | An SCP Deny matched | SCPs on the caller's account path |
| "with an explicit deny in a resource control policy" | An RCP Deny matched | RCPs on the resource's account path |
| "because no identity-based policy allows" | No allow on the principal | Role or user policies |
| "because no resource-based policy allows" | Resource policy didn't grant it (often cross-account) | Bucket, key or queue policy |
| "because no permissions boundary allows" | Boundary is the ceiling | The entity's boundary |
| "because no session policy allows" | The session was narrowed at creation | Whoever called STS |
| "because no VPC endpoint policy allows" | Traffic went through a restrictive endpoint | Endpoint policy |
| "...no role trust policy allows the sts:AssumeRole action" | The trust policy doesn't include the caller | Role trust policy, external ID, conditions |
- When several policy types deny, the message names only one. Fix it, retry, and check again.
- In CloudTrail, filter on
errorCodeAccessDeniedorUnauthorizedOperationand theuserIdentityARN to see every failed call. EC2 returns an encoded authorization message: decode it withsts:DecodeAuthorizationMessage. - For sign-in problems, CloudTrail logs
ConsoleLogin, Identity Center sign-in events, andAssumeRoleWithSAMLfailures (such as an invalid audience or an expired assertion). See troubleshooting monitoring.
Exam signal
"The error message says explicit deny in a service control policy, but the account admin can't find any deny in the account" means the SCP is attached higher up: an OU or the root. Only the management account or delegated admin can see and change it.
Scenarios
An organization-wide external access analyzer reports resources shared outside the organization, and its findings raise events for new sharing. Unused access analysis looks at roles and keys nobody uses, not external sharing. The simulator tests access for principals you pick, and can't discover who outside has access. Config public bucket rules miss cross-account grants, KMS keys and role trust policies.
CheckAccessNotGranted evaluates a policy document against actions you say must never be granted, and fits a CI gate. Unused access findings arrive after deployment. An SCP blocks the actions everywhere, including for the teams that legitimately need them, and doesn't review the policy. A manual simulator run doesn't block a merge.
The message names the endpoint policy as the layer that implicitly denies, so the endpoint policy needs an allow for that bucket. The bucket policy and boundary aren't what failed, and the error would name them if they were. Block Public Access doesn't affect private access through an endpoint.
Further reading
Organization policies and data perimeters
SCPs, RCPs, declarative policies and AI services opt-out policies in AWS Organizations, what each can and can't restrict, and how they combine into identity, resource and network perimeters.
Domain 5 · Data protection
18% of the exam. Who controls the keys, how traffic stays encrypted, how stored data survives deletion and ransomware, and how secrets and sensitive fields stay out of sight.