| name | aws-accessanalyzer |
| description | IAM Access Analyzer via AWS CLI v2 (`aws accessanalyzer`). Analyzers, findings, archive rules, access previews, policy tools. |
AWS CLI v2 — IAM Access Analyzer (accessanalyzer)
Overview
Complete reference for all aws accessanalyzer subcommands in AWS CLI v2. Covers analyzer management, findings lifecycle, archive rules, access previews, policy validation, policy generation, and custom policy checks. IAM Access Analyzer helps identify resources shared with external principals, detect unused access, and validate IAM policies against best practices. Supports account-level and organization-level analyzers for external access, unused access, and internal access analysis.
Quick Reference — Common Workflows
Create an account-level analyzer
aws accessanalyzer create-analyzer \
--analyzer-name my-account-analyzer \
--type ACCOUNT
Create an organization-level analyzer
aws accessanalyzer create-analyzer \
--analyzer-name my-org-analyzer \
--type ORGANIZATION
List all analyzers
aws accessanalyzer list-analyzers
List active findings for an analyzer
aws accessanalyzer list-findings \
--analyzer-arn arn:aws:access-analyzer:us-east-1:123456789012:analyzer/my-analyzer \
--filter '{"status": {"eq": ["ACTIVE"]}}'
Get details of a specific finding
aws accessanalyzer get-finding \
--analyzer-arn arn:aws:access-analyzer:us-east-1:123456789012:analyzer/my-analyzer \
--id 0910eedb-381e-4e95-adda-0d25c19e6e90
Archive findings
aws accessanalyzer update-findings \
--analyzer-arn arn:aws:access-analyzer:us-east-1:123456789012:analyzer/my-analyzer \
--ids 0910eedb-381e-4e95-adda-0d25c19e6e90 \
--status ARCHIVED
Create an archive rule
aws accessanalyzer create-archive-rule \
--analyzer-name my-analyzer \
--rule-name auto-archive-s3 \
--filter '{"resourceType": {"eq": ["AWS::S3::Bucket"]}, "isPublic": {"eq": ["false"]}}'
Validate a policy document
aws accessanalyzer validate-policy \
--policy-document file://policy.json \
--policy-type IDENTITY_POLICY
Check that a policy does not grant specific access
aws accessanalyzer check-access-not-granted \
--policy-document file://policy.json \
--access actions=s3:DeleteBucket,s3:GetBucketLocation \
--policy-type IDENTITY_POLICY
Generate a policy from CloudTrail activity
aws accessanalyzer start-policy-generation \
--policy-generation-details '{"principalArn":"arn:aws:iam::123456789012:role/MyRole"}' \
--cloud-trail-details file://trail-config.json
aws accessanalyzer get-generated-policy --job-id c557dc4a-0338-4489-95dd-739014860ff9
Create an access preview
aws accessanalyzer create-access-preview \
--analyzer-arn arn:aws:access-analyzer:us-east-1:123456789012:analyzer/my-analyzer \
--configurations file://preview-config.json
Command Reference
See index.md for the quick reference table and global options.
| Group | File | Commands |
|---|
| Analyzers | analyzers.md | create-analyzer, get-analyzer, list-analyzers, update-analyzer, delete-analyzer, get-analyzed-resource, list-analyzed-resources, start-resource-scan |
| Findings | findings.md | list-findings, get-finding, list-findings-v2, get-finding-v2, get-findings-statistics, update-findings, generate-finding-recommendation, get-finding-recommendation |
| Archive Rules | archive-rules.md | create-archive-rule, get-archive-rule, list-archive-rules, update-archive-rule, delete-archive-rule, apply-archive-rule |
| Access Previews | access-previews.md | create-access-preview, get-access-preview, list-access-previews, list-access-preview-findings |
| Policy Tools | policy-tools.md | validate-policy, check-access-not-granted, check-no-new-access, check-no-public-access, start-policy-generation, get-generated-policy, list-policy-generations, cancel-policy-generation |
| Tags | tags.md | tag-resource, untag-resource, list-tags-for-resource |
