Skip to main content

Enrollment

The Enrollment page shows every account enrolled in AWS IAM Access Analyzer, its current enrollment phase, and the analyzers Prism has created or adopted in it. Use it to add accounts, retry accounts that failed, and remove accounts from Access Analyzer.

Accessing Enrollment​

In the Security Hub sidebar, click IAM Access Analyzer > Enrollment.

If Access Analyzer has not been set up yet, the page shows an info banner, "IAM Access Analyzer is not set up yet for this customer", with a Go to setup button that opens the setup wizard.

Configuration Card​

At the top of the page, a Configuration card shows the current configuration, subtitled "IAM Access Analyzer runs standalone in each account - there is no delegated administrator":

  • Home region: the region Prism talks to by default, and the only region an unused-access analyzer is created in
  • Linking regions: every region where an external-access analyzer runs
  • Unused access: Off, or On with the tracking period in days
  • Status: the configuration status, for example Enabled, Partial Failure, or In Progress
info

There is no admin account on this page, and there is no admin chip on any row. Access Analyzer runs standalone in each account, so every enrolled account is a peer and each one holds its own analyzers. No account can be an administrator of another, and no account is exempt from removal. No AWS root email addresses are involved at any point.

Banners and Progress Bar​

Depending on the configuration status, one of these appears between the configuration card and the tables:

  • Setup failed. A red banner explains that nothing is running and nothing will resume on its own, that enrollment changes stay unavailable until setup is re-run, and that the accounts below show how far each one got. It carries a Re-run setup button. The tables still render, because they are the record of what happened.
  • Partial failure. An amber banner counts the accounts that did not finish enrolling, notes that every other account is analyzing normally, and points you at Retry on the rows below. A failed account is still enrolled, just not yet analyzing.

When one or more accounts are in an active phase, or the configuration itself is mid-operation, a progress bar appears below those banners. The page polls the server automatically and the bar advances as the job progresses.

Enrolled Accounts​

The Enrolled accounts card is subtitled "Each account holds its own analyzers" and carries a chip counting the enrolled accounts. Its table has six columns:

ColumnContents
AccountAccount name (account ID), or the bare account ID if Prism has no name for it
AnalyzersOne chip per analyzer cell, in the form region · Phase, with an Adopted marker where the analyzer was already there
StatusThe account's rolled-up phase chip, plus any error messages beneath it
AWS statusAccess Analyzer's own AnalyzerStatus for the cell, with its StatusReason beneath when AWS supplied one
RetriesHow many times the account has been retried, or - if never
ActionsRetry (failed rows only) and Remove

If no accounts are enrolled, the table shows an empty state: "No accounts enrolled yet - Pick accounts from the list below and add them to start analyzing access."

Phase Reference​

PhaseColourDescription
PendingGreyEnrollment submitted, waiting to start
Granting accessBluePrism is attaching the CKPrism-AccessAnalyzer-Permissions policy to the account's access role and waiting for it to take effect
EnablingBlueThe analyzers are being created, or an existing one adopted
EnabledGreenFully enrolled and analyzing
FailedRedEnrollment failed; see the error message below the chip
RemovingAmberRemoval is in progress
DisabledGreyThe capability was disabled for the organization
note

Granting access is the phase that takes the longest. Prism assumes the account's access role, attaches the policy, and then waits for the change to become usable, which can take several minutes per account. A row sitting in this phase is healthy, not stuck. The page keeps polling throughout.

Prism's Phase and AWS's Analyzer Status Are Different Things​

The Status column is Prism's own enrollment phase - how far Prism got. The AWS status column is what AWS IAM Access Analyzer reports about the analyzer itself, and they answer different questions:

AWS statusMeaning
ACTIVEThe analyzer is running and producing findings
CREATINGAWS is still provisioning it. This resolves on its own, usually within a minute or two
FAILEDAWS could not bring the analyzer up. The StatusReason beneath the chip is AWS's explanation, and it is the thing to read before acting
DISABLEDThe analyzer exists but is not analyzing

A row can read Enabled in Prism's column and FAILED in AWS's: Prism successfully created the analyzer, and AWS subsequently failed it. That combination is not a contradiction and not a Prism bug, which is why both columns are always shown. See Analyzer status shows FAILED for what each reason means.

Per-Cell Status​

Every row shows one chip per analyzer cell in the Analyzers column, in the form region · phase. The chips are always visible, there is nothing to expand.

Cells are not symmetric between the two families, and that is by design:

  • External access: one cell per linking region.
  • Unused access: one cell, in the home region only, and only when unused access is enabled. IAM is global, so a second one elsewhere would report the same roles again and be billed again. See The two analyzer families.

The account's own Status chip rolls those cell phases up to one, in this order of precedence:

  1. Failed, if any cell failed. It wins because it is the only phase that carries an action.
  2. Removing, Granting access, Enabling, then Pending, if any cell is in one of those, checked in that order.
  3. Enabled, otherwise.

Cells disagreeing is normal rather than exceptional in the flat peer model, most commonly because AWS IAM Access Analyzer is not available in one of the selected regions. Error messages, when present, appear beneath the status chip, each prefixed with the region it came from.

While an account is in an active phase, a small spinner sits next to its Status chip.

Adopted Analyzers​

A cell marked Adopted means an analyzer of that type already existed in the account and region when Prism enrolled it, so Prism read it rather than creating a new one. AWS permits only one analyzer per type, per account, per region, and that quota is not adjustable, so adoption is the only way to enrol such an account at all.

Ownership is decided by a Prism tag on the analyzer, never by its name, so an analyzer that merely happens to be named like Prism's is still treated as yours.

warning

An adopted analyzer is never deleted by Prism. Removing the account does not delete it, and disabling the capability does not delete it, because deleting an analyzer destroys every finding it has ever produced - those findings are your record and there is no undo. Prism detaches its permissions policy and stops reading the analyzer, and leaves the analyzer itself exactly where it was. See What removal leaves behind.

Retrying a Failed Account​

If an account shows Failed, a Retry button appears in its row.

  1. Read the AWS status and StatusReason first. If AWS reports FAILED, retrying will not help until the underlying reason is addressed.
  2. Click Retry next to the failed account.
  3. The account re-enters the enrollment phases from the beginning, including the grant step.
  4. If the retry fails again, read the error message. If it reports a permissions problem, open the Permissions tab in Settings and use Fix roles, then retry. If it names a region, check that AWS IAM Access Analyzer is available in that region.

The Retries column records how many times each account has been retried.

note

There is no "retry all", and this is deliberate. A retry claims the whole configuration while it runs, so a second retry dispatched immediately after the first is refused. Retry one account, let it settle, then retry the next.

note

Retrying one account never disturbs the accounts that already succeeded. Accounts are enabled independently, so a partial failure is a per-account condition to work through, not a state that has to be cleared before the working accounts produce findings.

Adding Accounts​

The Not enrolled table lists the accounts in your organization that Access Analyzer is not currently analyzing, including any previously removed accounts, which are labelled previously removed.

  1. Select the accounts you want to enroll. Use the header checkbox to select all at once, or check individual rows.
  2. Click Add N to Access Analyzer (where N is the number of selected accounts). With nothing selected the button reads Add to Access Analyzer and is disabled.
  3. Each account enters the enrollment phases, starting at Pending and moving on to Granting access.

When every linked account is already enrolled, the table shows an empty state: "Every linked account is enrolled - Nothing left to add - new accounts appear here once they join the organization."

info

No root email addresses are required. Access Analyzer has no invitation model, so unlike GuardDuty, Macie and Detective enrollment, there is no email step, no Enter root emails dialog, and no EmailVerificationFailed or VERIFICATION_FAILED failure mode. This is also why Access Analyzer, like Amazon Inspector, can be enrolled on installations where those three cannot.

warning

Adding an account while unused access is on starts a charge for that account. Unused-access analysis is billed at $0.20 per IAM role or user, per month, per account, so the cost of adding an account is driven by how many IAM principals it contains. External-access analysis, which is what an account gets when unused access is off, is free.

Removing an Account​

  1. In the Enrolled accounts table, click Remove in the account's row. The button is present on every row except one that is already Removing.
  2. A confirmation dialog, Remove account from Access Analyzer, appears showing the account ID and naming any adopted analyzers that will be left in place. There is nothing to type; click Remove to proceed or Cancel to back out.
  3. The account enters the Removing phase. When removal completes it drops out of the Enrolled accounts table and reappears in the Not enrolled table, flagged previously removed.
warning

Removing an account deletes the analyzers Prism created in that account across every linking region, deletes the findings Prism has cached from it, detaches the Access Analyzer permissions policy from its access role, and stops any unused-access charges for it. Re-adding the account later re-grants the policy and creates fresh analyzers.

Adopted analyzers are not deleted, and neither is the AWSServiceRoleForAccessAnalyzer service-linked role. See What removal leaves behind.

When Enrollment Changes Are Unavailable​

Add, Retry, and Remove are all disabled unless the configuration has settled, which means status Enabled or Partial Failure.

  • While an operation is running, an info banner above the Not enrolled table says "Enrollment changes are paused while the current operation finishes."
  • If setup failed, that banner is suppressed; nothing is going to finish. The red setup-failed banner at the top of the page is the accurate one, and re-running setup is the way out.

Live Auto-Polling​

While any account is in an active phase (Pending, Granting access, Enabling, or Removing), or while the configuration itself is in progress, the page polls the server automatically and updates the status chips and progress bar without a manual refresh.