AWS Identity and Access Management (IAM) Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, shared with an external entity. This lets you identify unintended access to your resources and data, which is a security risk. IAM Access Analyzer also provides policy generation which provides options to employ policy for IAM entities (users or roles) to help you refine the permissions that you grant.
| Capability ID | Capability Description | Category | Value | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|---|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1098.001 | Additional Cloud Credentials |
Comments
IAM Access Analyzer can protect against adversaries adding credentials to cloud accounts to maintain access. Its policy generation helps administrators remove unneeded permissions to create access keys or other credentials. It is scored as Partial because generated policies are based only on observed CloudTrail activity, and must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1098 | Account Manipulation |
Comments
IAM Access Analyzer can protect against adversaries manipulating accounts to maintain and/or elevate access to victim systems through its external access analysis and access policy generation. It is scored as Partial because findings are not generated in real time and must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | detect | partial | T1098.003 | Additional Cloud Roles |
Comments
IAM Access Analyzer can detect adversaries modifying IAM roles to maintain access to cloud environments. It generates a finding when a role trust policy is changed to allow external principals to assume the role. It is scored as Partial because it detects only changes that grant access to principals outside the zone of trust, not permissions added within the account, and generates findings periodically or when triggered rather than in real time.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | detect | partial | T1098 | Account Manipulation |
Comments
IAM Access Analyzer can detect adversaries manipulating accounts to maintain and/or elevate access to victim systems through its external access analysis. It is scored as Partial because findings are not generated in real time and must be acted upon by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1686.001 | Cloud Firewall |
Comments
IAM Access Analyzer can protect against adversaries modifying cloud firewalls to allow access or evade defenses. Its policy generation helps administrators remove unneeded permissions to modify security groups and network ACLs. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1685 | Disable or Modify Tools |
Comments
IAM Access Analyzer can protect against adversaries disabling or modifying security tools or applications through policy generation, which helps administrators remove unneeded permissions. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1685.002 | Disable or Modify Cloud Log |
Comments
IAM Access Analyzer can protect against adversaries disabling or modifying cloud logging to evade detection. Its policy generation helps administrators remove unneeded permissions to stop, modify, or delete AWS CloudTrail trails and other logs. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1666 | Modify Cloud Resource Hierarchy |
Comments
IAM Access Analyzer can protect against adversaries modifying the cloud resource hierarchy to evade defenses. Its policy generation helps administrators remove unneeded AWS Organizations permissions, such as leaving the organization or creating accounts. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1490 | Inhibit System Recovery |
Comments
IAM Access Analyzer can protect against adversaries deleting backups and snapshots to prevent recovery. Its policy generation helps administrators remove unneeded permissions to delete backups, snapshots, and recovery points. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1486 | Data Encrypted for Impact |
Comments
IAM Access Analyzer can protect against adversaries encrypting cloud data to disrupt availability. Its policy generation helps administrators remove unneeded permissions to use SSE-C on S3 buckets or overwrite stored objects. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1485.001 | Lifecycle-Triggered Deletion |
Comments
IAM Access Analyzer can protect against adversaries modifying storage lifecycle policies to delete data. Its policy generation helps administrators remove unneeded permissions to change S3 bucket lifecycle configurations. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1485 | Data Destruction |
Comments
IAM Access Analyzer can protect against adversaries destroying data and resources in cloud environments. Its policy generation helps administrators remove unneeded permissions to delete storage objects, buckets, and other resources. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1525 | Implant Internal Image |
Comments
IAM Access Analyzer can protect against adversaries implanting malicious images in cloud environments to maintain persistence. Its policy generation helps administrators remove unneeded permissions to register or modify machine and container images. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | detect | partial | T1537 | Transfer Data to Cloud Account |
Comments
IAM Access Analyzer can detect adversaries transferring data to cloud accounts they control. It generates a finding when a snapshot, S3 bucket, or other supported resource is newly shared with an external account. It is scored as Partial because it covers only supported resource types and generates findings periodically or when triggered rather than in real time.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1578.001 | Create Snapshot |
Comments
IAM Access Analyzer can protect against adversaries creating snapshots to bypass restrictions or access data. Its policy generation helps administrators remove unneeded permissions to create, copy, or share snapshots. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1578.002 | Create Cloud Instance |
Comments
IAM Access Analyzer can protect against adversaries creating cloud instances to evade defenses. Its policy generation helps administrators remove unneeded permissions to launch instances. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1578.003 | Delete Cloud Instance |
Comments
IAM Access Analyzer can protect against adversaries deleting cloud instances to remove evidence of their activity. Its policy generation helps administrators remove unneeded permissions to terminate instances. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1578.004 | Revert Cloud Instance |
Comments
IAM Access Analyzer can protect against adversaries reverting cloud instances to remove evidence of their activity. Its policy generation helps administrators remove unneeded permissions to restore or replace instance volumes. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1578.005 | Modify Cloud Compute Configurations |
Comments
IAM Access Analyzer can protect against adversaries modifying cloud compute configurations, such as quotas or allowed regions, to support malicious activity. Its policy generation helps administrators remove unneeded permissions to change these settings. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1548.005 | Temporary Elevated Cloud Access |
Comments
IAM Access Analyzer can protect against adversaries abusing role assumption or role passing to gain elevated access. Its policy generation helps administrators remove unneeded permissions such as sts:AssumeRole and iam:PassRole. It is scored as Partial because generated policies are based only on observed CloudTrail activity, and must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1651 | Cloud Administration Command |
Comments
IAM Access Analyzer can protect against adversaries abusing cloud administration services to run commands on virtual machines. Its policy generation helps administrators remove unneeded permissions for services such as AWS Systems Manager Run Command. It is scored as Partial because it reports findings and recommends policies without applying them.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1059.009 | Cloud API |
Comments
IAM Access Analyzer can protect against adversaries using cloud APIs to run malicious commands. Its policy generation helps administrators restrict identities to the API actions they actually use. It is scored as Partial because generated policies are based only on observed CloudTrail activity, and must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1098.003 | Additional Cloud Roles |
Comments
IAM Access Analyzer can protect against adversaries adding roles or permissions to maintain access. Its external access analysis identifies role trust policies modified to grant access to external principals, and its policy generation helps administrators remove unneeded IAM write permissions. It is scored as Partial because findings are not generated in real time, and generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1648 | Serverless Execution |
Comments
IAM Access Analyzer can protect against adversaries abusing serverless functions to execute code. It identifies AWS Lambda functions that external principals can invoke, and its policy generation helps administrators remove unneeded permissions to create, modify, or invoke functions. It is scored as Partial because it reports findings and recommends policies without applying them.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1555.006 | Cloud Secrets Management Stores |
Comments
IAM Access Analyzer can protect against adversaries retrieving credentials from cloud secrets management stores. It identifies AWS Secrets Manager secrets and AWS KMS keys shared with external accounts, so administrators can remove unintended access. It is scored as Partial because it reports findings without restricting access itself.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1199 | Trusted Relationship |
Comments
IAM Access Analyzer can protect against adversaries abusing trusted third-party relationships to access cloud resources. It identifies role trust policies and resource policies that grant access to principals outside the configured zone of trust, so administrators can remove unintended relationships. It is scored as Partial because findings are not generated in real time and access is not restricted automatically.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1078.004 | Cloud Accounts |
Comments
IAM Access Analyzer can protect against adversaries using compromised cloud accounts. It identifies IAM roles that external identities can assume, and its policy generation helps administrators reduce permissions to those used in CloudTrail activity, limiting what a compromised identity can do. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1537 | Transfer Data to Cloud Account |
Comments
IAM Access Analyzer can protect against adversaries transferring data to cloud accounts they control. It identifies snapshots, S3 buckets, and other supported resources shared with external accounts, including shares an adversary creates, so administrators can revoke that access. It is scored as Partial because it covers only supported resource types, runs periodically or when triggered rather than in real time, and reports findings without revoking access itself.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1530 | Data from Cloud Storage |
Comments
IAM Access Analyzer can protect against adversaries collecting data from cloud storage. It identifies Amazon S3 buckets and other supported storage resources that are shared publicly or with external accounts, so administrators can remove unintended access. It is scored as Partial because it covers only supported resource types, runs periodically or when triggered rather than in real time, and reports findings without restricting access itself.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | protect | partial | T1578 | Modify Cloud Compute Infrastructure |
Comments
IAM Access Analyzer can protect against adversaries modify a cloud account's compute service infrastructure through policy generation, which helps administrators remove unneeded permissions. It is scored as Partial because generated policies must be reviewed and applied by administrators.
References
|