search

aws / aws-cdk

The AWS Cloud Development Kit is a framework for defining cloud infrastructure in code
https://aws.amazon.com/cdk
Apache License 2.0
11.53k stars 3.86k forks source link

Construct for IAM Access Analyzer #5277

Open nataibi opened 4 years ago

nataibi commented 4 years ago

The announcement of IAM Access Analyzer on the 2nd December sees the introduction of a capability that mathematically analyzes access control policies attached to resources (S3, IAM Role, Lambda, KMS etc ...) and determines which resources can be accessed publicly or from other accounts

Use Case

This service provides a greater visibility into the aggregate impact of your access control strategy, making it easy to report and to automatically respond to findings unintended resource access

Proposed Solution

Implement CloudFormation Resource and CDK Construct for https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-accessanalyzer-analyzer.html

Other

References

https://aws.amazon.com/iam/features/analyze-access/

https://aws.amazon.com/blogs/aws/identify-unintended-resource-access-with-aws-identity-and-access-management-iam-access-analyzer/

https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html

This is a :rocket: Feature Request

comcalvi commented 1 year ago

CFN resource has been added: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-accessanalyzer-analyzer.html