Skip to main content

Settings

The Settings page lets you turn unused-access analysis on or off and change its tracking period, change the regions external-access analysis runs in, check and repair the permissions Access Analyzer needs in each account, and disable Access Analyzer entirely.

Accessing Settings​

In the Security Hub sidebar, click IAM Access Analyzer > Settings.

If Access Analyzer has not been set up yet, the page shows an info banner, "IAM Access Analyzer is not set up yet for this customer", with a Go to setup button that opens the setup wizard.

The page has four tabs: Unused access, Regions, Permissions, and Danger zone.

When Saving Is Unavailable​

Both Save buttons require a settled configuration, which means status Enabled or Partial Failure.

  • While an Access Analyzer operation is running, a progress bar at the top of the page reads "An Access Analyzer operation is running - settings are locked until it finishes", and the page polls until it does. You do not need to reload.
  • If setup failed, a red banner says so and offers Re-run setup. Unused access and regions cannot be changed until setup is re-run, but disabling Access Analyzer from the Danger zone still works.

Each Save button is also disabled until you actually change something, so a Save you have not earned is never live.

Unused Access Tab​

Controls whether Prism creates an ACCOUNT_UNUSED_ACCESS analyzer in each enrolled account, and how long a principal must go unused before it is reported.

ControlDefaultNotes
Enable unused access analysisOffA single toggle. The tracking period is disabled while it is off
Tracking period90 daysHow long an IAM role, access key or console password must go unused before Access Analyzer reports it

Update your selection and click Save unused access. Saving hands you off to the Enrollment page, because the change fans out across every enrolled account and that page is where a per-account failure becomes actionable.

warning

This tab is where you control the Access Analyzer bill. Unused-access analysis is the only part of AWS IAM Access Analyzer that AWS charges for, at $0.20 per IAM role or user, per month, per account - counted on the number of IAM principals in the account, not on the findings produced. Turning the toggle on starts that charge in every enrolled account; turning it off stops it. External-access analysis is free and is unaffected by this tab.

Prism creates exactly one unused-access analyzer per account, in the home region only, so the charge does not multiply by the number of linking regions.

warning

Turning unused access off deletes the analyzers Prism created for it, and deleting an analyzer destroys its findings. Every unused-access finding those analyzers produced is gone from AWS as well as from Prism, and turning the toggle back on later creates fresh, empty analyzers rather than restoring what was there. Prism confirms this before saving.

An unused-access analyzer that Prism adopted rather than created is not deleted - Prism simply stops reading it. See What removal leaves behind.

note

Charges may not be prorated mid-month. AWS bills unused-access analysis on a monthly basis per IAM role or user, and turning the capability off partway through a month does not necessarily produce a partial-month charge for that month. Treat the switch as a decision for the billing period rather than something to toggle back and forth.

note

Changing the tracking period does not change the price. It is a reporting threshold: a longer period reports fewer, more confident findings, a shorter one reports more, sooner. The next refresh re-reports against the new threshold, so findings can appear or disappear after a change without anything in your environment having moved.

Regions Tab​

Adds or removes the regions where external-access analysis runs. The tab is headed Linking regions.

  • Home region: shown as a read-only value; it cannot be removed. It is also the only region an unused-access analyzer is created in.
  • Linking regions: a multi-select list of AWS regions. The home region is locked in the list and cannot be deselected.

If your change drops any region, an amber warning appears above the button naming what saving will tear down. Click Save regions, and when regions are being removed a confirmation dialog, Confirm region removal, opens first. It names the regions being torn down, and if the same save also adds regions it says so. Confirm with Save regions in the dialog, or Cancel. As with unused access, a successful save hands you off to the Enrollment page.

warning

The linking-regions list is not a display filter. Adding a region creates an external-access analyzer there for every enrolled account. Removing a region deletes the external-access analyzers Prism created there - which destroys the findings they produced - and deletes the findings Prism has cached from that region. Adding the region back later creates fresh analyzers rather than restoring what was deleted.

Adopted analyzers in a removed region are left in place; Prism only stops reading them.

info

Adding a linking region does not change your unused-access bill. Only external-access analyzers fan out per region, and those are free. The unused-access analyzer stays at one per account, in the home region. See The two analyzer families.

note

AWS IAM Access Analyzer is not available in every AWS region. Selecting an unsupported region causes enablement to fail for that region only; the rest of the update still succeeds and the configuration settles in partial failure.

Permissions Tab​

Prism needs a small, enumerated set of Access Analyzer permissions in each enrolled account, which it attaches as a policy named CKPrism-AccessAnalyzer-Permissions on that account's access role. This tab, headed Account permissions, reports whether that policy is currently in place and correct in every enrolled account, and repairs it where it is not.

When you open the tab, a scan starts automatically and shows Checking account permissions… while it runs. Each account is then listed with its account ID, its permissions state, and any error detail:

StateMeaning
CurrentThe expected policy is attached and up to date
Needs updateA policy is attached but does not match what Prism expects
MissingNo policy is attached

Below the table:

  • Fix roles re-applies the policy to the affected accounts, then re-runs the scan so you can confirm the result. It is disabled when nothing needs attention.
  • Re-check re-runs the scan on its own, without changing anything.
  • A summary line reads either "All accounts are up to date." or "N accounts need attention."

If no accounts are enrolled yet, the tab says so instead of showing an empty table.

Use this tab when:

  • An account failed enrollment with a permissions or AccessDenied error; fix the roles, then Retry the account from Enrollment
  • The policy was removed or edited directly in AWS
  • A Prism update changed the set of permissions Access Analyzer requires

What the Policy Grants​

The policy grants exactly six AWS IAM Access Analyzer actions, plus one scoped service-linked-role permission, and nothing else:

ActionWhy Prism calls it
access-analyzer:CreateAnalyzerCreate the external-access analyzer in each linking region, and the unused-access analyzer in the home region
access-analyzer:TagResourceTag the analyzer as Prism-owned, which is how adoption and teardown tell Prism's analyzers apart from yours
access-analyzer:DeleteAnalyzerDelete an analyzer Prism created, on region removal, account removal, or a clean disable
access-analyzer:ListAnalyzersConfirm the permissions are usable in the account, discover an existing analyzer to adopt, and read each analyzer's status
access-analyzer:ListFindingsRead the findings in an analyzer during a refresh
access-analyzer:GetFindingRead one finding's full detail

Alongside them, the policy permits creation of the AWS service-linked role that Access Analyzer requires, AWSServiceRoleForAccessAnalyzer, restricted by a policy condition to access-analyzer.amazonaws.com and to no other service.

info

This is a standing grant, not a temporary escalation. The policy stays attached to each enrolled account's access role for as long as that account is enrolled, and is detached when the account is removed or when Access Analyzer is cleanly disabled.

Two things it deliberately does not contain:

  • No AWS Organizations actions, and no delegated-administrator actions. Prism has no route to your AWS management account, so every analyzer is created by the enrolled account itself through its own access role. This is also why the analyzers are account-scoped, which changes what counts as external - see Zone of trust.
  • No archive-rule actions. Access Analyzer's archive rules are configured per analyzer in the AWS console and are not managed by Prism. A rule you create there changes what AWS reports, and therefore what Prism caches, on the next refresh.

Danger Zone Tab​

Disables AWS IAM Access Analyzer for your entire organization. This tab stays available even when setup has failed; it is the way out of that state.

To disable Access Analyzer:

  1. Click Disable Access Analyzer.
  2. A confirmation dialog, Confirm disable, opens. It names how many analyzers will be deleted and how many adopted analyzers will be left in place. Type your customer ID into the Customer ID field exactly as shown in the dialog.
  3. Click Disable. The button stays disabled until what you typed matches exactly.

Prism then returns you to the Access Analyzer page, which narrates the teardown as Disabling IAM Access Analyzer… with a progress bar, and shows the setup wizard again once the status reaches disabled.

note

The typed customer ID is cleared whenever the dialog closes, so reopening it always starts from an empty field.

warning

Disabling deletes the analyzers Prism created in every enrolled account and region, removes the cached findings, and stops all unused-access charges. On a clean teardown Prism also detaches the IAM policy it added to each account's access role.

Deleting an analyzer destroys every finding it ever produced, in AWS as well as in Prism. Re-enabling Access Analyzer later creates fresh, empty analyzers that start from that moment.

What Removal Leaves Behind​

Removing an account, removing a region, turning unused access off, and disabling the capability all leave two things in your AWS account on purpose.

1. Adopted analyzers. An analyzer that already existed when Prism enrolled the account is never deleted by Prism, in any teardown path. Deleting an analyzer destroys every finding it has ever generated, and those findings are your record: they may predate Prism entirely, there is no undo, and there is no export. Prism detaches its permissions policy and stops reading the analyzer, and leaves the analyzer running exactly as it was. It also keeps producing findings - and, where it is an unused-access analyzer, keeps billing - until you delete it yourself in the AWS console.

Ownership is decided by the Prism tag on the analyzer, not by its name, so an analyzer that merely shares Prism's naming convention is still treated as yours and left alone.

2. The AWSServiceRoleForAccessAnalyzer service-linked role. AWS IAM Access Analyzer creates this role in each account the first time an analyzer is created there. Prism does not delete it on teardown: it is an AWS-managed role shared by every analyzer in the account, including any you create yourself later, and removing it would break an analyzer Prism does not own. The role grants no standing access to Prism - it is assumed by the AWS service, not by Prism - and it can be deleted in the AWS console once no analyzer in the account needs it.

note

Unused-access charges may not be prorated mid-month. AWS bills unused-access analysis monthly per IAM role or user. Disabling partway through a month does not necessarily produce a partial-month charge, and an adopted unused-access analyzer left behind continues to bill in full. If the bill is the reason you are tearing down, check the AWS console for analyzers Prism has left in place.

Partial Failure on Disable​

If every teardown step succeeds, the configuration moves to disabled, the cached findings are cleared, and the setup wizard is shown again.

If any teardown step genuinely fails, the configuration stays in partial_failure rather than moving to disabled, so the affected accounts stay visible for retry and billable unused-access analysis is never silently left running. In that case the permission policies are not detached and the cached findings are retained, and the status message names every account that did not tear down. Re-open Settings and disable again to retry the remaining teardown; a repeated teardown treats already-removed resources as success, so retrying is safe.

An adopted analyzer left in place is not a teardown failure and never holds the configuration in partial_failure. Leaving it is the intended outcome, not an error.

info

You can re-enable Access Analyzer at any time by running the setup wizard again. If an analyzer Prism left behind is still there, the new enrollment adopts it.