Dashboard
The Dashboard is the landing page for IAM Access Analyzer after setup completes. It summarizes every active finding Prism has cached across your enrolled accounts and regions, breaks them down by severity, reports how many analyzers of each family are in place, and then breaks the same findings down by type and by account.
Accessing the Dashboard
In the Security Hub sidebar, click IAM Access Analyzer. If Access Analyzer is enabled, you land directly on the Dashboard.
Header
The header summarises the deployment on one line: the home region, how many accounts are enrolled across how many regions, whether unused access is on or off, and Last refresh as a relative time such as 2 min ago, or never when no refresh has completed yet. After a clean refresh it also reports how many findings were fetched. Alongside it sits a Refresh findings button that fetches the latest findings from AWS.
If the configuration is in partial failure, a warning banner appears above the tiles reading "Some accounts are not fully enrolled in IAM Access Analyzer", followed by the error, with a Review button through to Enrollment, where the affected accounts are listed.
The Dashboard reads from Prism's cache of the last refresh, not live AWS data. Click Refresh findings to fetch current findings. If a refresh started elsewhere is already running when you open the page, the Dashboard detects it and picks up its progress rather than showing an idle page; the button reads Refreshing… and is disabled, with a Refresh already in progress tooltip on hover.
Severity Tiles
Five tiles break down your active findings by severity:
| Tile | Meaning |
|---|---|
| Critical | Public access that includes a write action |
| High | Public access, or an access key that has gone unused |
| Medium | Cross-account external access, an unused role, or an unused console password |
| Low | An unused permission, or a finding the analyzer could not evaluate |
| Informational | Reserved; Access Analyzer findings do not normally land here |
Click any tile to open the Findings page pre-filtered to that severity. A line beneath the tiles gives the Total active findings across all severities, summed over every tile so the breakdown and the total can never disagree.
These severities are computed by Prism, not by AWS. AWS IAM Access Analyzer ships no severity field at all - neither the console nor the API assigns one - so a customer comparing these tiles against the AWS console will find nothing to compare them to. Prism derives a severity from what each finding actually says so that Access Analyzer can be triaged alongside the other engines. The full mapping is documented at Severity is computed by Prism.
There is no Untriaged tile here. UNTRIAGED is Amazon Inspector's value for a finding AWS has not yet scored, and Access Analyzer never emits it - every Access Analyzer finding is assigned a severity by Prism at ingest, so none can be un-assigned.
Analyzer Coverage
Beneath the severity breakdown, four coverage tiles appear in this order:
| Stat | Meaning |
|---|---|
| Accounts covered | How many accounts are enrolled and analyzing. This is counted from the enrolled accounts, not from the findings, so an enrolled account with zero findings still counts as covered |
| Regions covered | How many linking regions have a live external-access analyzer, counted the same way |
| External-access analyzers | How many ACCOUNT analyzers are in place, across all accounts and linking regions. Always free |
| Unused-access analyzers | How many ACCOUNT_UNUSED_ACCESS analyzers are in place - one per enrolled account, home region only. Shows Off when unused access is not enabled |
Accounts covered and Regions covered are clickable, opening Enrollment and Settings respectively.
A caption below the row reports how many of those analyzers were adopted rather than created by Prism, because adopted analyzers behave differently on teardown. See Existing analyzers are adopted, never deleted.
The unused-access tile counts one analyzer per account, not per region, and that is correct. IAM is a global service, so a second unused-access analyzer in another region would report the same roles again under different finding IDs and be billed again. See The two analyzer families.
Findings by Type
A breakdown of active findings by Access Analyzer finding type, in a Type and Count table ordered by count, highest first. Select a type row to open the Findings page filtered to it.
| Family | Type | Meaning |
|---|---|---|
| External access | ExternalAccess | A resource policy grants access to a principal outside the account's zone of trust |
| Unused access | UnusedIAMRole | An IAM role that has not been assumed within the tracking period |
| Unused access | UnusedIAMUserAccessKey | An IAM user access key that has not been used within the tracking period |
| Unused access | UnusedIAMUserPassword | An IAM user console password that has not been used within the tracking period |
| Unused access | UnusedPermission | A service or action permission granted to a role or user that it has never exercised |
The unused-access rows are present only when unused access is enabled. With it off, this table shows external-access findings alone, which is the expected state - not a sign that unused-access analysis has failed.
Per-Account Findings
A table of every account with active findings, with an Account column and an Active findings count, ordered by count, highest first. Select an account row to open the Findings page filtered to that account. Accounts that are enrolled but currently have no active findings do not appear here; use Enrollment to see the full enrolled list.
A high external-access count in one account is often intra-organization trust rather than exposure. Prism creates account-scoped analyzers, so a grant to another account in your own AWS Organization is reported as external. Read the per-account counts with that in mind and check the principal on the findings themselves before treating a spike as an incident. See Zone of trust.
Refreshing Findings
Click Refresh findings to fetch the latest findings from AWS for every enrolled account and region. The button reads Refreshing… and is disabled while the job runs, with a Refresh already in progress tooltip on hover.
While it runs, a progress bar appears beneath the header with a caption reading how many findings have been fetched so far, and how many accounts could not be reached if any have failed.
A refresh caches only the findings AWS currently reports as active, and it removes cached findings that AWS no longer reports. That means a bucket policy you have tightened, or a role you have deleted, drops out of the Dashboard on the next refresh rather than lingering, and the counts reflect your current posture rather than accumulated history.
Pruning only happens for units the refresh walked completely. If a refresh is cut short for an account or region, Prism keeps that unit's existing rows rather than deleting findings it simply did not reach, so an interrupted refresh never looks like a sudden improvement in posture.
Globally scoped findings are fetched from the home region only. IAM roles are global, so the same role produces findings in every region's analyzer under different finding IDs. Ingesting them from every region would report the same trust policy several times and count it several times. Prism reads global resource types from the home-region analyzer alone, which is why a role's trust-policy finding shows the home region even when the role is used elsewhere.
Partial and Failed Refreshes
Because each account is fetched independently, a refresh finishing with gaps is a normal outcome rather than a failure. When that happens a warning banner reports "Refresh finished with gaps", how many findings were fetched, how many accounts were unreachable, and how many account-region units went unscanned, and states that the counts below cover only what was scanned.
If the refresh job fails outright, an error panel replaces the progress bar with the job's error message and a retry action.
Empty States
- IAM Access Analyzer is not configured, shown with a Reload button when Access Analyzer is disabled for the organization, including when it is disabled in another tab while this page is open.
- No findings detected yet, shown in the Findings by type table when Access Analyzer is enabled and refreshed but no active findings exist. For external access this genuinely means no resource policy in the analyzed accounts grants access outside its zone of trust, which is a healthy result rather than a broken one.
- No accounts with active findings, shown in the per-account table under the same conditions.
Related Pages
- Findings, Browse and filter the full findings list, and how severity is computed
- Enrollment, Check which accounts are enrolled and retry failures
- Settings, Change unused access and regions
- Security Hub Issues, Troubleshooting refresh problems