Hi, everyone, and welcome back.
Now, in today's video, we are going to discuss about the IAM access analyzer.
Now at a very high level overview, there are three primary capabilities that this specific service
provides.
First one is that it allows organizations to identify the resources in your organization and accounts
that are shared with the external entity.
Now, this is a very useful feature.
We'll be discussing about this in just the moment.
The second primary capability here is that it validates the IAM policies against the policy, grammar
and best practices.
And third primary capability here is that it generates the IAM policies based on the access activity
in your cloud logs.
So all of these three are quite interesting capabilities.
So let's go ahead and look into each one of them.
So first let's explore the capability.
One of the IAM access analyzer, which is to identify the shared resource.
So at a high level overview, the IAM access analyzer helps you identify the resources in your organizations.
So this resources can be three buckets IAM rules, EBS, snapshots, etc. that are shared with an external
entity.
So let's understand this with a small animation where you have a critical S3 bucket.
Over here there are a lot of important contents in this S3 bucket and this S3 bucket is shared with
an external client.
So you have one external access and it is also shared with an external account.
So there are two external access to this critical S3 bucket.
So this qualifies to be a resource which is shared with an external entity.
Now, like this, there can be hundreds of different resources within your organization.
Most of the time what happens is you add the external access and then you forget to remove it after
the work is done.
So this is where the access analyzer helps you.
Now, for this diagram we had taken an example of S3 bucket, but there are a lot of other resources
that are supported.
Now if we look into the overall supported resource types, you have the S3 buckets, you have the IM
roles, the CMS, SDKs, secret manager secrets, the elastic block store snapshots and so on.
Now before we proceed into a demo, let's look into some of the important pointers to note.
First one is that for each instance of a resource that is shared outside of a US account, IAM access
analyzer generates a finding and after the finding is generated, you can go ahead and review the finding
whether it is as intended or it is not intended and you can fix it.
So if you look into the overall finding, it looks something similar to the one that you see in the
screenshot.
You see you have the EBS snapshot, IAM rule and S3 bucket.
All of them are shared with the external principle.
For example, your S3 bucket is shared with an external IP with 1010633213.
So before we continue, let's go ahead and explore this specific capability.
Now from the IAM console, you have the access analyzer which you can enable it.
So I have it enabled in the Singapore region.
So let's go to the Singapore region here.
And within year, you see there are certain findings that you will see.
So let's quickly expand this.
So you have a finding related to the EBS snapshot, finding related to a cross account IAM role and
finding related to a S3 bucket.
So all of these findings that you see, these resources are shared externally of your account.
For example, this S3 bucket collection cross account Demo S3 bucket is shared with a specific IP address
over here and how is it shared?
It is shared through a bucket policy.
Along with that, it also shows you what was the access level that is associated.
So you have read, write, read and list.
So let's open up one of the findings.
So once you see this specific finding, you can go ahead and archive it.
For example, let's say that this is a genuine one so you can go ahead and archive this finding so that
you will not really see as part of the active finding.
If it is not intended, then you can go to the S3 console to fix your bucket policy.
For example, it directly took me to the S3 bucket.
Now, if you look into the permissions, let's go a bit down.
This is the bucket policy and you can go ahead and remove this specific condition so that the external
access can be removed.
All right.
So I hope with this at a high level overview, you understood about the capability, number one, which
is to identify the resource that are shared with the external entity.
Now, this is a very important capability, primarily because when you have hundreds of accounts, you
will forget whom you have shared your resources with specifically when there are so many services that
are available.
So this is where the access analyzer really helps.
The second primary capability is related to validating an IAM policy, so it allows you to validate
your policy against the policy grammar and the best practices.
So you can view the policy validation check the finding, it shows you the security warnings errors.
General warning suggestions for your policy.
For example, if you look into this screenshot, you have a policy that is written which is allow action
is the resources star and it is showing you a security warning over here.
For example, let's go ahead and quickly edit this specific bucket policy.
So you see that you have the security, you have the errors, the warnings, as well as the suggestions.
For example, let's say in the action, I see a star in the source.
Also.
I see a star.
All right.
So immediately you see certain warnings have been generated.
So you have security errors, warnings as well as the suggestion.
So depending upon how you write your overall policy, it displays you.
And this really helps in many scenarios.
Otherwise, what happens is that if your policy is failing, you will have to do a bit of research into
why exactly is failing.
However, here it is clearly stating that the condition operator IP address.
So this specific one is used with an invalid IP range value and it is stating specify the IP range in
the standard CIDR format.
So this is very useful.
So if you say 00000.
All right, so you see the warning went away and there is one specific suggestion now and within here,
if you just click on Learn More, it basically takes you to the IAM access analyzer policy validation.
All right.
So I hope with this you understood the basics of the overall validation.
And the third interesting capability here is generating the IAM policy.
So at a high level overview, the access analyzer can analyze your cloud logs to identify the actions
and the services that has been used by a specific IAM entity.
So this IAM entity can be user or role and based on what actions and the services that have been used
by this user or role, The access analyzer can generate an IM policy based on those specific activity.
For example, here you see in this screenshot you can specify the time period and you can also specify
the cloud logs that needs to be analyzed.
So it will go ahead and validate against the cloud logs of a specific region and then the policy will
automatically be created.
So let's also go ahead and quickly explore that.
So let's quickly go back to the IAM console.
Will go to users.
Here I have a demo user and for this demo user I have an option of generate policy based on cloud trail
events.
So this is what we were discussing.
So based on the Cloud Trail event associated with a demo user, a policy have been generated.
So if you look into the generated policy, so here you can see the actions that are included.
So we have Lambda as three security Hub, LP, etc..
Let's quickly do our next and you see the policy is generated for you so you can modify it at an overview
and then deploy the overall policy.
So let's quickly go a bit back now again, note that this is a demo video.
We are not doing a practical from scratch.
The aim here is to understand about the capabilities of the access analyzer at the overview.
Now, generally when you generate a policy, let's say I want to generate a new policy so you can specify
the date or you can specify that based on the activity of a user from last 20 days in a cloud drill,
say, cloud trail of Singapore, you can select appropriate drill, generate a policy grid.
So this is a very high level overview about the three primary capabilities of the IAM access analyzer,
and with this will conclude today's video.