Access Analyzer off in this region

Severity: Medium
Service: IAM Access Analyzer
Check ID: ACCESSANALYZER_OFF

What this check finds

IAM Access Analyzer reports which of your resources can be reached by principals outside the account — public S3 buckets, roles trusted by another account, KMS keys shared externally. It is free and read-only. This finding is REGIONAL: an analyzer covers only the region it was created in, so having one in eu-west-2 does not cover us-east-1. If you see this finding alongside Access Analyzer results elsewhere in the report, that is not a contradiction — an analyzer is active in one region and absent in this one. External-access results for regions that do have an analyzer are reported separately as "Resource shared outside the account".

Passing looks like: IAM Access Analyzer enabled.

How to fix it

Enable IAM Access Analyzer in each region you use — one analyzer per region, they do not cover each other.

AWS CLI

aws accessanalyzer create-analyzer --analyzer-name account-analyzer --type ACCOUNT --region REGION

To cover every account in the organisation from a delegated administrator, use --type ORGANIZATION (still one per region).

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

IAM → Access Analyzer → Create analyzer, with the region selector set to this region.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Access Analyzer off in this region
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.19 Ensure that IAM External Access Analyzer is enabled for all regions
PCI-DSS v4.0.1	10.7 Failures of critical security control systems are detected, reported, and responded to promptly 11.3 External and internal vulnerabilities are regularly identified, prioritized, and addressed
HIPAA Security Rule	164.308(a)(1) Security Management Process — Risk Analysis
NIST SP 800-53 Rev5 (Moderate)	AC-6 Least Privilege CA-7 Continuous Monitoring
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege DE.CM-09 Computing resources are monitored
ISO/IEC 27001:2022 Annex A	A.5.36 Compliance with policies, rules and standards for information security A.8.2 Privileged access rights A.8.16 Monitoring activities

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM Access Analyzer checks

LowResource shared outside the account

All IAM Access Analyzer checks