An S3 bucket or IAM role might be exposed to another account unintentionally.
Find external access paths from resource policies.
Which service is most appropriate?
Enable IAM Access Analyzer to analyze resource policies and identify external access paths.
Detailed explanation
Bucket size does not indicate who is permitted to access the bucket.
Bucket size does not indicate who is permitted to access the bucket.
Observed requests do not reveal an unused but permitted external access path.
Observed requests do not reveal an unused but permitted external access path.
DNS resolution does not analyze IAM resource policies.
DNS resolution does not analyze IAM resource policies.
Access Analyzer analyzes resource policies and reports access reachable by external principals.
Access Analyzer analyzes resource policies and reports access reachable by external principals.
Check official documentation
Compare the following points with the official documentation.
IAM Access Analyzerの公式説明を確認する。
What to confirm
実際のアクセスログと、ポリシー上の到達可能性分析を区別できる。
Key points
- IAM Access Analyzer
- External principal
- Resource policy
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Reachability
Analyzer reports access that policy logic permits even when no request has occurred.
Policy review
Findings provide a basis for narrowing resource policies.