# The machine-generated inventory of every resource an external entity can reach — IAM Access Analyzer's active ExternalAccess findings — read against the declared zone of trust, so the terms-and-conditions review has a list to work from rather than a memory

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/external-access-inventory-and-trust-boundary

Recipe id: `external-access-inventory-and-trust-boundary` · cadence quarterly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-SCR-MIT`
- KSI `KSI-IAM-ELP`
- control `ac-20`

## Collection

Kind: `cli`

```sh
# list-analyzers
aws accessanalyzer list-analyzers --query 'analyzers[].{Name:name,Type:type,Status:status,Arn:arn,LastAnalyzedAt:lastResourceAnalyzedAt}'
# list-findings-v2
aws accessanalyzer list-findings-v2 --analyzer-arn <ANALYZER_ARN> --filter '{"status":{"eq":["ACTIVE"]},"findingType":{"eq":["ExternalAccess"]}}'
# describe-organization
aws organizations describe-organization --query 'Organization.{Id:Id,FeatureSet:FeatureSet,ManagementAccount:MasterAccountId}'
# iam-external-access-analyzer-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name iam-external-access-analyzer-enabled --compliance-types NON_COMPLIANT
```

## Expected output

From list-analyzers, one row per analyzer with type ACCOUNT or ORGANIZATION for external access (the ACCOUNT_UNUSED_ACCESS, ORGANIZATION_UNUSED_ACCESS, ACCOUNT_INTERNAL_ACCESS and ORGANIZATION_INTERNAL_ACCESS types answer different questions and do not produce ExternalAccess findings) and status one of ACTIVE, CREATING, DISABLED, FAILED. From list-findings-v2, one finding per resource shared outside the zone of trust, each with resource, resourceType, resourceOwnerAccount, findingType, status, createdAt and analyzedAt. From describe-organization, the organization id, FeatureSet ALL or CONSOLIDATED_BILLING, and the management account id — the boundary an ORGANIZATION analyzer treats as internal. From the Config rule, an empty NON_COMPLIANT set means an external-access analyzer is enabled and ACTIVE in that Region.

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

IAM Access Analyzer and Organizations operate in GovCloud (US); analyzer and resource ARNs use partition arn:aws-us-gov. The Config managed rule IAM_EXTERNAL_ACCESS_ANALYZER_ENABLED is NOT available in either GovCloud (US) Region — its published availability excludes GovCloud (US-East) and GovCloud (US-West) — so in GovCloud the fourth call has no rule to query and the analyzer's own status field from list-analyzers is the evidence that it is enabled.

## Notes

AC-20 is a two-limb control and only one limb is in this output. The limb that is here: which external entities can reach organization-controlled information. Access Analyzer answers that by logic-based reasoning over resource-based policies, and every access by a principal INSIDE the zone of trust is trusted by definition, so a finding is exactly an access that crosses the boundary the organization declared. The limb that is not here: whether each of those crossings is covered by terms and conditions consistent with the trust relationship. That is an agreement — a contract, an interconnection security agreement, an authorization to connect — and no call returns it. Attach the agreement register and reconcile it finding by finding; the reconciliation, not the finding list, is the AC-20 artifact.

The inventory also has a direction. Access Analyzer sees resources you share OUT. It does not see an external system your people use to process organization information — a SaaS tool reached from a workstation leaves no resource policy in your account and produces no finding. That half of AC-20 has to come from your own third-party register, and inventing a join between the two would make the coverage claim wider than the evidence.

Three scope facts worth pinning down before the count is quoted. External-access analysis is REGIONAL: an analyzer evaluates only resources in the Region where it is enabled, so one analyzer per Region in use, or the inventory is silently partial. Fifteen resource types are analyzed for external access — S3 buckets and directory buckets, IAM roles, KMS keys, Lambda functions and layers, SQS queues, Secrets Manager secrets, SNS topics, EBS volume snapshots, RDS DB and DB cluster snapshots, ECR repositories, EFS file systems, DynamoDB streams and tables — and a resource type outside that list is not covered by the analyzer at all. And findings refresh within about 30 minutes of a policy change but can lag up to 24 hours when a change notification is missed, so a finding list is a recent state, not a live one.

## References

- {"title":"Using IAM Access Analyzer — zone of trust, ExternalAccess findings, the fifteen analyzed resource types, and the regional scope of external-access analysis","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html"}
- {"title":"AWS CLI: accessanalyzer list-analyzers (type ACCOUNT | ORGANIZATION | *_UNUSED_ACCESS | *_INTERNAL_ACCESS; status ACTIVE | CREATING | DISABLED | FAILED)","url":"https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/list-analyzers.html"}
- {"title":"AWS CLI: accessanalyzer list-findings-v2 (filterable on status and findingType; returns resource, resourceType, resourceOwnerAccount, analyzedAt)","url":"https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/list-findings-v2.html"}
- {"title":"AWS Config managed rule: iam-external-access-analyzer-enabled (IAM_EXTERNAL_ACCESS_ANALYZER_ENABLED) — unavailable in both AWS GovCloud (US) Regions","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-external-access-analyzer-enabled.html"}
- {"title":"AWS CLI: organizations describe-organization (Id, FeatureSet, management account; AvailablePolicyTypes is deprecated — use list-roots instead)","url":"https://docs.aws.amazon.com/cli/latest/reference/organizations/describe-organization.html"}