cis-aws-foundations-2.18

Ensure that IAM External Access Analyzer is enabled for all regions

Description

Enable IAM External Access Analyzer for all resources in each active AWS region.

IAM Access Analyzer is a service that analyzes resource policies to identify resources that can be accessed from outside the account. After the analyzer is enabled, scan results are displayed in the console showing accessible resources. These results help determine whether unintended access is permitted, making it easier for administrators to monitor least privilege access. Access Analyzer analyzes only policies applied to resources within the same AWS region.

Rationale

IAM External Access Analyzer helps identify resources in your account or organization that are shared with external entities. This allows detection of unintended access to resources and data. It continuously monitors policies for services such as S3 buckets, KMS keys, Lambda functions, and SQS queues.

Impact

If IAM External Access Analyzer is not enabled, unintended external access to resources may go undetected, increasing the risk of data exposure or unauthorized access.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam
2. Under Access analyzer choose Analyzer Settings
3. On the Analyzer Settings page, review the list of analyzers
4. Identify analyzers where the Finding type is External Access
5. Repeat these steps for each active region, as analyzers are region-specific

Using AWS CLI

1. Run the following command:

aws accessanalyzer list-analyzers --type <ACCOUNT|ORGANIZATION> --region <region_name> | grep status

2. Ensure that at least one Analyzer's status is set to ACTIVE

3. To check all regions:

for r in $(aws ec2 describe-regions --query "Regions[].RegionName" --output text); do
  echo "=== $r ==="
  aws accessanalyzer list-analyzers --region "$r" --type ACCOUNT --query "analyzers[].status" --output text
done

4. Ensure each region returns at least one ACTIVE analyzer

Expected Result

Every active AWS region should have at least one IAM External Access Analyzer with ACTIVE status. The analyzer should be configured with Finding type set to External Access.

Remediation

Using AWS Console

Perform the following to enable IAM Access Analyzer for IAM policies:

1. Open the IAM console at https://console.aws.amazon.com/iam/
2. Choose Access analyzer
3. Select Create analyzer
4. Select External access analyzer
5. Confirm the region
6. Optionally provide a name and tags
7. Select Create analyzer
8. Repeat for each active region

Using AWS CLI

1. Create an analyzer in a region:

aws accessanalyzer list-analyzers --type <ACCOUNT|ORGANIZATION> --region <region_name> | grep status

2. Repeat for each region as required

Default Value

By default, IAM External Access Analyzer is not enabled in any region. An analyzer must be explicitly created in each region.

References

1. https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html
2. https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html
3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/accessanalyzer/get-analyzer.html
4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/accessanalyzer/create-analyzer.html

Additional Information

• IAM Access Analyzer is region-specific and must be enabled in each region
• For multi-account environments, consider using an ORGANIZATION analyzer to centralize findings
• Some AWS regions are enabled by default, while others must be manually enabled

CIS Controls

Profile

Level 1 | Automated