Skip to main content

Enabling Access Analyzer

The Access Analyzer setup wizard walks you through four steps to deploy AWS IAM Access Analyzer across your organization. After you submit, an asynchronous job attaches the required permissions to each selected account's access role, waits for those permissions to take effect, and then creates or adopts the analyzers in each account and region.

Accessing the Wizard​

  • If no Security Hub engine is enabled yet, the Security Hub Overview page drops straight into the Enable Security Hub capability panel. Click Enable on the Access analysis card.
  • If another engine (CSPM, GuardDuty, Macie, Inspector, or Detective) is already live, the Overview instead shows one tile per engine; the IAM Access Analyzer tile carries an Enable button. The same panel is also available at Configuration > Capabilities, where the Access analysis card's button reads Enable, and Configure once Access Analyzer is on.
  • While Access Analyzer is not enabled, the sidebar shows a single Enable IAM Access Analyzer row that opens the same wizard. Once it is enabled, that row becomes an IAM Access Analyzer group containing Dashboard, Findings, Enrollment, and Settings.

Wizard Steps​

StepNameWhat you configure
1AccountsThe AWS accounts to analyze
2RegionsThe home region and every region external-access analysis runs in (labelled Analyzed regions)
3Unused accessWhether to opt in to unused-access analysis, and its tracking period
4ReviewConfirm all settings before submitting

Next stays disabled until the step you are on is complete, and Back is disabled on step 1. You can move back and forth freely before submitting.

info

There is no admin-account step and no emails step. Access Analyzer uses a flat peer model with no delegated administrator and no invitation flow, so no account is nominated as an administrator and no AWS root email addresses are needed. This is the same model Amazon Inspector uses.

Prerequisites​

  • At least one AWS account is onboarded in Prism

Step 1: Accounts​

Select the AWS accounts you want Access Analyzer to analyze. Every selected account gets its own analyzers and is enabled independently and on equal footing; none of them is an administrator over the others.

FieldRequiredNotes
AccountsYesMulti-select checkbox list; each option reads Account name (account ID)

The picker has a Select all row at the top (it flips to Deselect all once everything is chosen), and summarizes the current selection as chips, collapsing to +N more past six. If Prism returns no linked accounts, the wizard says so under the field: "No linked AWS accounts were returned for this organization."

note

You can add or remove accounts after setup from the Enrollment page without rerunning the wizard.

Step 2: Regions​

Select the home region and every region where external-access analysis runs.

FieldRequiredDefaultNotes
Home regionYesus-east-1Single-select; changing it adds the new region to Analyzed regions automatically
Analyzed regionsYesus-east-1Multi-select; the home region is locked in the list and cannot be deselected

An external-access analyzer is created in every region you pick, for every enrolled account. AWS IAM Access Analyzer only evaluates policies attached to resources in the same region as the analyzer, which is why external access needs one analyzer per region rather than one per account. Because there is no aggregation account, the home region is not an aggregation region; Prism does the aggregating itself.

The home region does two things the others do not: it is where the unused-access analyzer is created, if you opt in on the next step, and it is the only cell that globally scoped findings - IAM role trust policies among them - are ingested from.

note

The field is labelled Analyzed regions in the wizard. Everywhere else in Prism, the same list is called Linking regions, on the Enrollment page's configuration card and on the Settings Regions tab.

warning

Adding a linking region does not multiply your unused-access bill, and does not reduce it either. Unused access is created once per account, in the home region only, regardless of how many linking regions you select. External-access analyzers, which are free, are the ones that fan out per region. See The two analyzer families.

warning

AWS IAM Access Analyzer is not available in every AWS region. Selecting an unsupported region causes enablement to fail for that region only; the rest of the enablement still succeeds. The configuration then settles in partial failure and the affected cells are listed on the Enrollment page.

Step 3: Unused Access​

Choose whether Prism also creates an unused-access analyzer in each enrolled account. This step is where you control the Access Analyzer bill.

FieldRequiredDefaultNotes
Enable unused access analysisNoOffA single toggle. Everything below it is disabled while it is off
Tracking periodYes when the toggle is on90 daysHow long a role, user, access key or password must go unused before it is reported

With the toggle off, Prism creates external-access analyzers only, and Access Analyzer costs you nothing.

With the toggle on, Prism creates one ACCOUNT_UNUSED_ACCESS analyzer per enrolled account, in the home region only, which reports:

  • IAM roles that have not been assumed within the tracking period
  • IAM user access keys that have not been used within it
  • IAM user passwords that have not been used within it
  • Unused permissions - service and action permissions granted to a role or user that it has never exercised
warning

Unused-access analysis is the only part of AWS IAM Access Analyzer that AWS charges for. It is billed at $0.20 per IAM role or user, per month, per account, counted on the number of IAM principals analyzed rather than on the findings produced. An account with 150 roles and users is therefore about $30 per month; twenty such accounts about $600 per month.

External-access analysis is free, and stays free whether this toggle is on or off. The wizard shows the price beside the toggle, under this caveat: "Prices are indicative us-east-1 list prices for orientation only - actual charges vary by region and by AWS pricing changes."

note

The tracking period is a reporting threshold, not a billing lever. A longer period reports fewer, more confident findings; a shorter one reports more, sooner. Neither changes the price, which is driven by how many IAM principals exist in the account. You can change the period at any time from Settings, and the next refresh re-reports against the new threshold.

info

Unused access can be turned on later, or turned off again, from the Unused access tab in Settings. Turning it off deletes the unused-access analyzers Prism created and stops the charge; turning it back on creates fresh ones. An unused-access analyzer that Prism adopted rather than created is never deleted - see Existing analyzers are adopted, never deleted.

Step 4: Review​

The Review step summarizes your selections before you submit, in this order:

  • Accounts
  • Home region
  • Analyzed regions
  • Unused access, either Off or On, 90-day tracking period, with the indicative monthly cost restated when it is on

Below the summary, the wizard restates the blast radius: how many external-access analyzers will be created (accounts × analyzed regions, free), how many unused-access analyzers (one per account, billed), and that enrollment runs per account so a failure in one does not stop the others.

Click Enable Access Analyzer to submit. The button reads Enabling… while the request is in flight.

If the request is rejected, the error is shown on the Review step rather than jumping you to another step, because every rejection here (an account that does not belong to the organization, an unsupported region, Access Analyzer already enabled) is reachable with Back.

What Happens After Submission​

After you click Enable Access Analyzer, the wizard hands off to an asynchronous job. The wizard body is replaced by a status card headed Setting up IAM Access Analyzer…, with a progress bar and the home region and account count beneath it. The card polls the server and hands over to the Access Analyzer dashboard as soon as the run settles.

For each selected account, the job:

  1. Assumes that account's access role and attaches the CKPrism-AccessAnalyzer-Permissions policy to it (phase Granting access)
  2. Waits until those permissions are actually usable in the account, IAM changes take time to propagate, so this phase can run for several minutes
  3. Creates the external-access analyzer in each linking region, and the unused-access analyzer in the home region if you opted in (phase Enabling)
  4. Marks the account Enabled
note

The Granting access phase legitimately takes minutes. The page keeps polling throughout and the per-account phases update on their own, but the progress bar can sit at the same percentage for a long stretch while IAM propagates. A long pause here is normal and is not a stalled job.

When an Analyzer Already Exists​

If a cell already holds an analyzer of the type Prism is creating, AWS refuses the creation - with ServiceQuotaExceededException when the existing analyzer has a different name, and ConflictException when it has the same one, because the quota is one analyzer per type per account per region and is not adjustable.

Neither is treated as a failure. Prism adopts the analyzer that is already there, records it against the enrollment, and reads its findings from then on. The account reaches Enabled normally, and the Enrollment page marks the cell Adopted.

warning

An adopted analyzer is never deleted by Prism, not when you remove the account and not when you disable the capability, because deleting an analyzer destroys every finding it has ever produced. See What removal leaves behind.

Partial Success​

Accounts are enabled independently, so some can succeed while others fail. If any account or region fails, the overall status becomes partial_failure:

  • The accounts that succeeded are live and start producing findings straight away.
  • The Dashboard shows a warning banner, "Some accounts are not fully enrolled in IAM Access Analyzer", followed by the failure detail and a Review button that opens Enrollment.
  • The Enrollment page lists each failing account with its error message and a Retry button.
  • If the failure was a permissions problem, use the Permissions tab in Settings to re-check and Fix roles.

Nothing is rolled back on partial failure, and retrying one account does not disturb the others.

info

A prior failed or disabled Access Analyzer configuration is cleared automatically when you resubmit the wizard. You do not need to manually delete the old state before running setup again. If the last attempt failed, the wizard opens with a warning carrying that failure's message and a reminder that submitting again clears the state and retries.