# Active unused-access findings identifying IAM roles, access keys, console passwords, and service/action-level permissions that have not been used within the configured age, driving right-sizing and removal

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/iam-access-analyzer-unused-access

Recipe id: `iam-access-analyzer-unused-access` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-IAM-ELP`
- KSI `KSI-IAM-JIT`
- control `ac-2.3`
- control `ac-6.7`

## Collection

Kind: `cli`

```sh
# account-unused-access-analyzers
aws accessanalyzer list-analyzers --type ACCOUNT_UNUSED_ACCESS --query 'analyzers[].{arn:arn,status:status,age:configuration.unusedAccess.unusedAccessAge}'
# organization-unused-access-analyzers
aws accessanalyzer list-analyzers --type ORGANIZATION_UNUSED_ACCESS --query 'analyzers[].{arn:arn,status:status,age:configuration.unusedAccess.unusedAccessAge}'
# unused-access-findings
aws accessanalyzer list-findings-v2 --analyzer-arn <UNUSED_ACCESS_ANALYZER_ARN> --filter '{"status":{"eq":["ACTIVE"]}}'
```

## Expected output

JSON findings array; each finding has a findingType of UnusedIAMRole, UnusedIAMUserAccessKey, UnusedIAMUserPassword, or UnusedPermission, with the affected resource ARN and status

## Assertions

- {"field":"account-unused-access-analyzers[].status","op":"eq","value":"ACTIVE","controls":["ac-2.3","ac-6.7"],"description":"Every unused-access analyzer is ACTIVE — a DISABLED or CREATING analyzer also returns zero findings."}
- {"field":"account-unused-access-analyzers[].age","op":"lte","value":90,"controls":["ac-2.3","ac-6.7"],"description":"The tracking period is no longer than the 90-day review period, or an entity unused for 91 days is not yet a finding."}
- {"field":"unused-access-findings.findings[]","op":"count_eq","value":0,"where":[{"field":"status","op":"eq","value":"ACTIVE"},{"field":"findingType","op":"in","value":["UnusedIAMRole","UnusedIAMUserAccessKey","UnusedIAMUserPassword"]}],"controls":["ac-2.3"],"description":"No role, access key or console password has gone unused past the analyzer's configured age."}
- {"field":"unused-access-findings.findings[]","op":"count_eq","value":0,"where":[{"field":"status","op":"eq","value":"ACTIVE"},{"field":"findingType","op":"eq","value":"UnusedPermission"}],"controls":["ac-6.7"],"description":"No principal retains a service or action permission it has not exercised."}

## GovCloud

IAM Access Analyzer is available in AWS GovCloud (US); analyzer and resource ARNs use partition arn:aws-us-gov

## Notes

Use list-findings-v2 (list-findings is external-access only and does not return unused-access findings). Requires an existing ACCOUNT_UNUSED_ACCESS analyzer; create one with create-analyzer --type ACCOUNT_UNUSED_ACCESS --configuration '{"unusedAccess":{"unusedAccessAge":90}}'. Target zero ACTIVE unused-permission findings for privileged roles. An empty findings list is meaningful only if an analyzer exists, is ACTIVE, and its unusedAccessAge equals the review period the SSP declares; entities younger than the tracking period, and principals or accounts excluded by tag, never appear as findings. UnusedPermission findings are computed for roles, so IAM users' unused permissions are outside this output, and AC-06 (07)(a)'s periodic review is a human record — which is why this is partial.

## References

- {"title":"Create an IAM Access Analyzer unused access analyzer (tracking period, 1–365 days)","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-create-unused.html"}
- {"title":"IAM Access Analyzer findings","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-findings.html"}
- {"title":"AWS CLI: accessanalyzer list-findings-v2 (findingType UnusedIAMRole / UnusedIAMUserAccessKey / UnusedIAMUserPassword / UnusedPermission; status ACTIVE / ARCHIVED / RESOLVED)","url":"https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/list-findings-v2.html"}