Hi, everyone, and welcome back.
Now, in the earlier video we were discussing about the basics of the IAM access analyzer and the capabilities
that it offers.
Now, in today's video, we'll have a quick practical related to the access analyzer and we'll look
into how we can verify the capabilities associated with it.
Now, from the management console, you can go to the IAM console so I'm access analyzer can be opened
from here.
So you have the access analyzer.
And what you need to do.
You can go ahead and you can create the analyzer.
Now, whenever you're creating the analyzer, you can create it.
The zone of trust here can be the current organization in case if you have, or it can also be the current
account.
Just for simplicity, I'll just select the current account and I'll create the analyzer.
Now, at this stage you see that it was able to quickly get some findings.
So the finding is that there is a bucket which is allowing some external resource through the bucket
policy and you also have a cross account IAM rule.
Now in case if you do not have this in your account, that is completely fine.
You can go ahead and quickly create it to identify this.
So let's do one thing.
Let's use a very simplistic approach will in fact we'll jump to the easy to console and let's do one
thing.
Let's go ahead and quickly create a EBS volume.
I'll create a very small EBS volume of one GB.
I'll go ahead and create this volume.
And once this volume is available, you can go ahead and quickly create a snapshot associated with this
volume.
All right.
Now, if you look into the snapshot, the snapshot is completed.
Now, this snapshot can be shared with other accounts as well.
So you see, you can modify the permission, you can add the account ID over here.
So let's do one thing.
Let's go ahead and add the account.
I'll specify an account ID that I have.
So let me add one more account ID So this is an external account.
This is a different account and I'll save the change.
So the external account now has access to this specific EBS snapshot.
So ideally what will happen is in the findings over here you should be able to see the new finding associated
with the EBS volume.
Now note that it is not instantaneous.
It takes a little amount of time for the new findings to appear.
So till the time a new finding appears, let me also quickly show you a few more things.
So whenever you see a finding in the access analyzer, you can go ahead and review it.
For example, I have one finding associated with a cross account in rule and it is shared with a specific
account.
Now, when you check this specific finding and you see that this is as expected and you do not really
want to see it in the active finding over here because you have evaluated and things are perfectly well.
So now what you can do, you can archive this specific finding.
Now when a finding is archived, it is removed from this active finding over here.
And this gives you a nice view to look into the actionable pointers.
So if I refresh once more now you see that you have one more finding related to the EBS snapshots.
If you open this finding, it will show you which is the external account to which this snapshot has
been shared with.
It also shows you what is the access level associated with it.
Now, one more thing before we conclude is that it shows you the option of re scan.
So let's say that this is the finding which is an actionable finding.
This was not expected.
So now what you do after you go through the finding, you remove this specific permissions.
So let's modify the permission.
Let's remove the account and I'll save the change.
Let's verify the permissions.
Things seems to be resolved.
So now what you can do to verify if things are resolved, you can just re scan it and now you see the
status has changed to result.
Now, if you go back to the findings, you will only see one finding associated with the S3 bucket and
in the result you will see one more finding that we had just resolved.