# Accessanalyzer Diagnostics

> >

- **Type:** Skill
- **Install:** `agentstack add skill-aws-samples-sample-ai-agent-skills-accessanalyzer-troubleshooting`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [aws-samples](https://agentstack.voostack.com/s/aws-samples)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT-0
- **Upstream author:** [aws-samples](https://github.com/aws-samples)
- **Source:** https://github.com/aws-samples/sample-ai-agent-skills/tree/main/accessanalyzer-troubleshooting

## Install

```sh
agentstack add skill-aws-samples-sample-ai-agent-skills-accessanalyzer-troubleshooting
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# IAM Access Analyzer Diagnostics

## When to use

Any IAM Access Analyzer investigation — analyzer creation, finding management, external access detection, unused access analysis, policy validation, policy generation, or archive rule configuration.

## Investigation workflow

### Step 1 — Collect and triage

```
aws accessanalyzer list-analyzers --query 'analyzers[*].{Name:name,Arn:arn,Type:type,Status:status}'
version: "1.0.0"
last_updated: "2025-04-12"
aws accessanalyzer list-findings --analyzer-arn  --filter '{"status":{"eq":["ACTIVE"]}}'
aws accessanalyzer list-archive-rules --analyzer-name 
```

### Step 2 — Domain deep dive

```
aws accessanalyzer get-analyzer --analyzer-name 
aws accessanalyzer get-finding --analyzer-arn  --id 
aws accessanalyzer validate-policy --policy-document file://policy.json --policy-type IDENTITY_POLICY
```

### Step 3 — Detailed investigation

```
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=access-analyzer.amazonaws.com --max-results 20
aws accessanalyzer get-generated-policy --job-id 
aws accessanalyzer list-findings --analyzer-arn  --filter '{"resourceType":{"eq":["AWS::S3::Bucket"]}}'
```

Read `references/guardrails.md` before concluding on any Access Analyzer issue.

## Tool quick reference

| Tool / API | When to use |
|------------|-------------|
| `accessanalyzer list-analyzers` | List analyzers |
| `accessanalyzer get-analyzer` | Get analyzer details |
| `accessanalyzer list-findings` | List findings with filters |
| `accessanalyzer get-finding` | Get finding details |
| `accessanalyzer validate-policy` | Validate IAM policy |
| `accessanalyzer start-policy-generation` | Generate policy from activity |
| `accessanalyzer create-archive-rule` | Create archive rule |

## Gotchas: IAM Access Analyzer

- Access Analyzer has TWO types: ACCOUNT (analyzes within account) and ORGANIZATION (analyzes across organization). Organization type requires Organizations admin.
- External access findings identify resources shared with external principals (other accounts, public). This is the original Access Analyzer capability.
- Unused access findings identify unused IAM roles, access keys, passwords, and permissions. This is a newer capability with separate pricing.
- Policy validation checks IAM policies against best practices and grammar. It does NOT check if the policy is effective — only if it's well-formed.
- Policy generation creates policies based on CloudTrail activity. It requires CloudTrail logging and sufficient activity history (90 days recommended).
- Archive rules automatically archive findings matching criteria. Archived findings are NOT deleted — they're hidden from active view.
- Findings are generated asynchronously. New resources may take up to 24 hours to be analyzed.

## Anti-hallucination rules

1. Always cite specific analyzer ARNs, finding IDs, or API responses as evidence.
2. ACCOUNT vs ORGANIZATION analyzers have different scopes. Never conflate them.
3. External access and unused access are separate capabilities. Never mix them up.
4. Policy validation checks grammar, not effectiveness. Never claim it validates permissions.
5. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.

## 14 runbooks

| Category | IDs | Covers |
|----------|-----|--------|
| A — Analyzer | A1-A2 | Creation, configuration |
| B — Findings | B1-B2 | Finding management, finding resolution |
| C — External Access | C1-C2 | External access detection, cross-account |
| D — Unused Access | D1-D2 | Unused access analysis, unused permissions |
| E — Policy Validation | E1-E2 | Validation errors, validation best practices |
| F — Policy Generation | F1-F2 | Generation setup, generation results |
| G — Archive Rules | G1-G2 | Archive rule creation, archive management |
| Z — Catch-All | Z1 | General troubleshooting |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [aws-samples](https://github.com/aws-samples)
- **Source:** [aws-samples/sample-ai-agent-skills](https://github.com/aws-samples/sample-ai-agent-skills)
- **License:** MIT-0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-aws-samples-sample-ai-agent-skills-accessanalyzer-troubleshooting
- Seller: https://agentstack.voostack.com/s/aws-samples
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.