Findings
The Findings page lists the AWS IAM Access Analyzer findings stored in Prism from the last refresh. You can filter by account, severity, and status, search by title, and open any finding to see the principal it grants access to, the actions and conditions involved, the affected resource, and - for unused access - when the principal was last used.
Accessing Findings
In the Security Hub sidebar, click IAM Access Analyzer > Findings. You can also reach this page pre-filtered from the Dashboard:
- a severity tile opens the list filtered to that severity
- a Findings by type row opens the list filtered to that finding type
- a Per-account findings row opens the list filtered to that account
Access Analyzer findings also appear in the unified Security Hub findings inbox alongside CSPM, GuardDuty, Macie, Inspector and Detective findings, where an extra Engine column tags each row IAM Access Analyzer. This page is that same inbox scoped to Access Analyzer, so the two always agree about what a finding looks like.
The findings list shows results from the last refresh, not live AWS data. If the list appears stale, run Refresh findings from the Dashboard.
Two Families in One List
Every row is one of two very different things, and the Type it carries is what tells them apart:
- An external-access finding says that a resource policy in the account grants access to a principal outside the account's zone of trust. It is about a resource.
- An unused-access finding says that an IAM role, access key, password or permission has gone unused for longer than the tracking period. It is about a principal.
Unused-access rows only exist when unused access is enabled in Settings. With it off, this page shows external-access findings alone.
An external-access finding naming one of your own accounts is not a false positive. Prism creates account-scoped analyzers, whose zone of trust is the individual account, so a grant to a role in another account in your own AWS Organization is correctly reported as external. An organization-scoped analyzer - which Prism cannot create, because it holds no management-account access - would treat the same grant as trusted and say nothing. Read the Principal field before triaging. See Zone of trust.
Severity Is Computed by Prism
AWS IAM Access Analyzer ships no severity field at all. Neither the console nor the API assigns one to an external-access or an unused-access finding, so there is no AWS value for Prism to mirror and nothing in the AWS console to compare a Prism severity against. If you are diffing the two, this is why they differ: the AWS console has no severity column to differ from.
Prism therefore derives a severity at ingest, from what the finding itself reports, so that Access Analyzer findings can be triaged and ranked alongside every other engine's. The rules are fixed, are applied identically to every finding, and are as follows.
External access
Evaluated in order; the first row that matches wins.
| Condition | Severity |
|---|---|
| The analyzer reported an error for the finding - it could not evaluate the policy, so there is no public flag, principal or action to judge | Low |
| The access is public and at least one granted action is a write | Critical |
| The access is public | High |
| Anything else, so cross-account access to a named principal | Medium |
A "write" is any granted action whose name contains Put, Create, Update, Delete, Write, or a wildcard *, matched case-insensitively. s3:PutObject and s3:* are writes; s3:GetObject is not.
Unused access
Each unused-access type has a base severity, and a principal that has never been used at all is raised one band.
| Finding type | Base severity | Never used |
|---|---|---|
UnusedIAMUserAccessKey | High | Critical |
UnusedIAMUserPassword | Medium | High |
UnusedIAMRole | Medium | High |
UnusedPermission | Low | Medium |
"Never used" is the worst case, not the best one. A credential with no last-used timestamp has never been exercised since it was created - it is standing access that nobody has ever needed. Prism raises it a band rather than treating an absent timestamp as missing data, so a long-forgotten access key sorts above a key that was used last quarter.
Access Analyzer findings never carry UNTRIAGED. That value belongs to Amazon Inspector, for findings AWS has not yet scored. Every Access Analyzer finding is assigned one of CRITICAL, HIGH, MEDIUM, LOW or INFORMATIONAL at ingest, so none can be un-assigned, and the findings list offers no Untriaged chip.
Findings Table
Rows are ordered newest first by when Access Analyzer last observed the finding. Each row represents one finding:
| Column | Description |
|---|---|
| Severity | Severity chip: CRITICAL, HIGH, MEDIUM, LOW, or INFORMATIONAL, computed as above |
| Title | The finding title: the resource for an external-access finding, the principal for an unused-access one |
| Resource type | The affected resource type as AWS reports it, for example AWS::S3::Bucket, AWS::KMS::Key, AWS::IAM::Role, or AWS::SQS::Queue. The resource's own identifier is not in this column; it is in the detail drawer |
| Account | The AWS account where the finding was detected |
| Region | The AWS region whose analyzer reported the finding |
| Status | Active, Archived, or Resolved |
| Last observed | When Access Analyzer last reported the finding |
Click any row to open the Finding Detail drawer.
The table loads 50 findings at a time. When more are available, a Load more button appears beneath the table and appends the next page. The Results heading counts what is currently loaded, and shows a trailing + (for example 50+ shown) while further pages remain.
A globally scoped finding always shows the home region. IAM roles are global, so the same role trust policy produces a finding in every region's analyzer, each with a different finding ID. Prism ingests global resource types from the home-region analyzer only, so each one is reported once. The region column on such a row names the home region, not the region the role happens to be used in.
Filtering
Use the Filters card above the table to narrow the list:
- Account: a dropdown of the accounts enrolled in Access Analyzer, shown as
Account name (123456789012). It defaults to All accounts - Search title: free-text search against the finding title, which is also how you search for a bucket name, a role name or a principal account ID
- Severity: toggle chips for CRITICAL, HIGH, MEDIUM, LOW, and INFORMATIONAL. Multiple selections are combined with OR
- Status: toggle chips for Active, Archived, and Resolved
No filter is applied when you open the page: every chip starts unselected and the list shows all cached findings.
Arriving from a Findings by type row on the Dashboard adds a removable Type: UnusedIAMRole chip above the severity and status chips. There is no type dropdown on this page; the chip is how that filter is shown and removed.
While any filter is active, the Filters card header shows an N active chip and a Clear filters (N) button appears in the page header. All filters are reflected in the page URL so a filtered view can be shared or bookmarked.
Prism's refresh caches only findings AWS currently reports as active, and prunes those AWS stops reporting. In practice the list is therefore active findings; the Archived and Resolved filters exist because AWS can report a finding in those states during the window before the next refresh prunes it, and because an archive rule configured on the analyzer in the AWS console changes what AWS reports.
Empty States
The table shows one of two messages when it has no rows, and they mean different things:
- No findings match these filters, with "Clear a filter or widen the search to see more findings." This appears only when a filter is active, and means the filter is too narrow, not that the estate is clean
- No findings yet, with "Findings appear here as soon as your enrolled accounts report them." This is the unfiltered case. For Access Analyzer it can genuinely mean no resource policy grants access outside its zone of trust, which is a healthy result
Finding Detail
Selecting a finding opens a right-hand detail drawer. Its header carries the finding title, a severity chip, and a status chip reading Active, Archived, or Resolved. Below that are up to five sections. A field with no value is omitted rather than shown empty.
Overview
Opens with a finding-type chip and a severity chip, followed by:
| Field | Description |
|---|---|
| Finding ID | Access Analyzer's identifier for the finding |
| Finding type | For example External access, Unused IAM role, or Unused permission |
| Analyzer | The analyzer that reported it, and whether Prism created or adopted it |
| Account | The AWS account the finding belongs to |
| Region | The AWS region whose analyzer reported it |
| First seen | When Access Analyzer first reported the finding |
| Last seen | When Access Analyzer last reported the finding |
Access
Shown for external-access findings.
| Field | Description |
|---|---|
| Public | Whether the grant is open to everyone, as a chip reading YES or NO |
| Principal | The principal the resource policy grants access to. For a cross-account grant this is the account ID or role ARN, and it is the field to read before deciding whether a finding is intra-organization trust |
| Actions | The actions the grant permits. Any write action here is what raises a public finding to Critical |
| Condition | The policy condition keys that qualify the grant, when the policy carries any |
Unused Access
Shown for unused-access findings.
| Field | Description |
|---|---|
| Principal | The IAM role or user the finding is about |
| Last accessed | When the role, key or password was last used, or Never used when it has never been exercised |
| Tracking period | The number of days configured in Settings, for context on what "unused" meant for this finding |
| Unused permissions | For an UnusedPermission finding, the service and actions granted but never exercised |
Resource
| Field | Description |
|---|---|
| Resource type | The affected resource type, the same value the table column shows |
| Resource | The resource's own ARN, for example an S3 bucket, a KMS key, or an IAM role |
| Resource owner | The account that owns the resource |
Analyzer Error
Shown only when Access Analyzer reported that it could not evaluate the finding. It carries AWS's error text. Such a finding has no public flag, no principal and no actions, which is why Prism rates it Low rather than guessing.
Access Analyzer findings are read-only in Prism. The drawer offers only a Close button, there is no archive, suppress, or workflow action. AWS IAM Access Analyzer owns the state of the finding, Prism mirrors it read-only, and archiving it in the AWS console - or configuring an archive rule on the analyzer there - shows up here after the next refresh. A finding also leaves the list when AWS stops reporting it as active, which is what happens once you have actually tightened the policy or deleted the credential, and the next refresh prunes it from the cache.
Related Pages
- IAM Access Analyzer, Zone of trust, the two analyzer families, and cost
- Dashboard, Severity tiles, analyzer coverage, and the refresh control
- Enrollment, Confirm which accounts are being analyzed
- Settings, Turn unused access on or off, and change the tracking period
- Security Hub Issues, Troubleshooting findings refresh problems