Active unused-access findings identifying IAM roles, access keys, console passwords, and service/action-level permissions that have not been used within the configured age, driving right-sizing and removal
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
partial — needs judgementclicontinuousIAM Access Analyzer
Fetch
$ aws accessanalyzer list-analyzers --type ACCOUNT_UNUSED_ACCESS --query 'analyzers[].{arn:arn,status:status,age:configuration.unusedAccess.unusedAccessAge}'$ aws accessanalyzer list-analyzers --type ORGANIZATION_UNUSED_ACCESS --query 'analyzers[].{arn:arn,status:status,age:configuration.unusedAccess.unusedAccessAge}'$ aws accessanalyzer list-findings-v2 --analyzer-arn <UNUSED_ACCESS_ANALYZER_ARN> --filter '{"status":{"eq":["ACTIVE"]}}'Expected output
JSON findings array; each finding has a findingType of UnusedIAMRole, UnusedIAMUserAccessKey, UnusedIAMUserPassword, or UnusedPermission, with the affected resource ARN and status
Assertions — what makes it a pass
| Field | Must be | For | Proves |
|---|---|---|---|
| account-unused-access-analyzers[].status | eq "ACTIVE"Every unused-access analyzer is ACTIVE — a DISABLED or CREATING analyzer also returns zero findings. | every row | AC-02 (03)AC-06 (07) |
| account-unused-access-analyzers[].age | lte 90The tracking period is no longer than the 90-day review period, or an entity unused for 91 days is not yet a finding. | every row | AC-02 (03)AC-06 (07) |
| unused-access-findings.findings[] | count_eq 0No role, access key or console password has gone unused past the analyzer's configured age. | status eq "ACTIVE"findingType in ["UnusedIAMRole","UnusedIAMUserAccessKey","UnusedIAMUserPassword"] | AC-02 (03) |
| unused-access-findings.findings[] | count_eq 0No principal retains a service or action permission it has not exercised. | status eq "ACTIVE"findingType eq "UnusedPermission" | AC-06 (07) |
Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.
Map — what it proves
- recipe2
Key Security Indicators
NIST 800-53 controls
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:AC 16/50 →
GovCloud
IAM Access Analyzer is available in AWS GovCloud (US); analyzer and resource ARNs use partition arn:aws-us-gov
Notes & assertions
Use list-findings-v2 (list-findings is external-access only and does not return unused-access findings). Requires an existing ACCOUNT_UNUSED_ACCESS analyzer; create one with create-analyzer --type ACCOUNT_UNUSED_ACCESS --configuration '{"unusedAccess":{"unusedAccessAge":90}}'. Target zero ACTIVE unused-permission findings for privileged roles. An empty findings list is meaningful only if an analyzer exists, is ACTIVE, and its unusedAccessAge equals the review period the SSP declares; entities younger than the tracking period, and principals or accounts excluded by tag, never appear as findings. UnusedPermission findings are computed for roles, so IAM users' unused permissions are outside this output, and AC-06 (07)(a)'s periodic review is a human record — which is why this is partial.
References
- Create an IAM Access Analyzer unused access analyzer (tracking period, 1–365 days) https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-create-unused.html
- IAM Access Analyzer findings https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-findings.html
- AWS CLI: accessanalyzer list-findings-v2 (findingType UnusedIAMRole / UnusedIAMUserAccessKey / UnusedIAMUserPassword / UnusedPermission; status ACTIVE / ARCHIVED / RESOLVED) https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/list-findings-v2.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Identity and Access Management run (16)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under IAM, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAccount-wide credential report proving MFA is active per principal and that passwords/access keys are rotated within policymonthlyiam-credential-reportIAM
- partialFull snapshot of every IAM user, group, role, and attached/inline policy with their relationships, used to review that granted permissions match least-privilege intentquarterlyiam-account-authorization-detailsIAM
- partialActive unused-access findings identifying IAM roles, access keys, console passwords, and service/action-level permissions that have not been used within the configured age, driving right-sizing and removalyou are herecontinuousiam-access-analyzer-unused-accessIAM Access Analyzer
- partialAWS Config compliance result for the managed rule proving every IAM user with a console password has MFA enabledcontinuousconfig-mfa-enabled-console-accessAWS Config · IAM
- partialAWS Config compliance result proving long-lived IAM access keys (including those used by service/non-user identities) are rotated within the maximum agecontinuousconfig-access-keys-rotatedAWS Config · IAM
- partialAWS Config compliance result proving no customer-managed IAM policy grants full administrative access (Allow Action:* on Resource:*)continuousconfig-iam-policy-no-admin-accessAWS Config · IAM
- narrativeDocumented just-in-time / break-glass privilege-elevation process backed by IAM Identity Center permission sets and account assignments, showing privileged access is role/attribute-based, time-bound, and approval-gated rather than standingquarterlyidentity-center-jit-elevation-workflowIAM Identity Center
- partialGuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principalcontinuousguardduty-suspicious-iam-activity-responseGuardDuty · CloudTrail · IAM
- partialHow operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable insteadweeklyremote-access-authorization-and-monitoringAWS Systems Manager Session Manager · AWS Client VPN · AWS Config · Amazon EC2
- partialEvery way a workforce user can authenticate into the account, counted and named in one pass — how many IAM users and federated trusts exist, which SAML and OIDC providers are registered, whether an IAM Identity Center instance is the workforce entry path — together with the state of the two credentials that belong to no person: the root user's access key and the account's X.509 signing certificatemonthlyidentity-sources-and-root-credential-lockdownAWS IAM · AWS IAM Identity Center · AWS Config
- partialFor every Amazon Cognito directory that fronts non-organizational users: the user pool's multi-factor configuration, and every identity pool's guest-access flag together with the named external providers it will exchange a token forweeklycognito-external-user-authenticationAmazon Cognito · AWS IAM
- partialThe configured ceiling on how long any credential stays valid before its holder must present an authenticator again — MaxSessionDuration on every IAM role, SessionDuration on every IAM Identity Center permission set, and the aws:MultiFactorAuthAge conditions in policy that expire an MFA-backed session independently of the session itselfquarterlysession-lifetime-and-reauthenticationAWS IAM · AWS IAM Identity Center · AWS STS
- partialThe mechanism that ends a temporary or emergency account without anyone deciding to: the AWS Config rule that measures how long an IAM credential has gone unused, the period it is configured with, the remediation configuration proving the revocation fires automatically, and an empty non-compliant set showing nothing has outlived the periodcontinuoustemporary-account-automatic-revocationAWS Config · AWS IAM · AWS Systems Manager Automation
- partialEvery identifier the account has issued, with the date it was assigned and the AWS-generated unique id behind it; the workforce identifiers issued through IAM Identity Center and the external issuer each one came from; and the CloudTrail record of identifiers being deleted, which is the only dated evidence of a name becoming free to reusecontinuousidentifier-assignment-and-reuse-preventionAWS IAM · AWS IAM Identity Center · AWS CloudTrail
- partialThe state of every credential in the account as of a stated moment, the enabled-or-disabled status of every workforce identity in the identity store, and the CloudTrail record of the revocations themselves — the five API calls that actually revoke standing access, each with the time it happened and the administrator who did itcontinuouspersonnel-separation-access-revocationAWS IAM · AWS IAM Identity Center · AWS CloudTrail
- partialWhat a transferred individual can still reach, and what they have actually used: the reassignment events themselves from CloudTrail (group membership, attached policy, and Identity Center account-assignment changes, each with its time and the administrator who made it), the current Identity Center assignments per permission set, and IAM's service-last-accessed report for the identities involved — a per-principal view of which services the identity is permitted to reach and which of those it has never authenticated to. `iam-access-analyzer-unused-access` answers the same question estate-wide from findings; this answers it for the named principal a transfer is about.continuouspersonnel-transfer-access-reassignmentAWS IAM · AWS IAM Identity Center · AWS CloudTrail