AWS IAM Access Evaluation Tools: Analyzer, Simulator, and Credential Reports – SAP-C02 Study Guide

Purpose of This Lesson

AWS IAM provides several tools for understanding who can access resources, how credentials are configured, and which permissions a user or role actually receives. These tools support security reviews, least-privilege design, troubleshooting, and policy refinement.

The key distinction is that each tool answers a different question:

• IAM Access Analyzer: Is a resource accessible by an external principal or more broadly than intended?
• IAM credential report: Are IAM users and the root account using secure credentials and MFA?
• IAM Policy Simulator: What would happen if a principal attempted a specific API action?
• IAM policy generation: Which permissions have been observed in CloudTrail and may be required by a role?

Key Concepts

IAM Access Analyzer

IAM Access Analyzer evaluates resource-based access policies and produces findings when resources can be accessed by principals outside the intended trust boundary. Depending on the analyzer configuration, findings may identify resources that are publicly accessible or accessible from another AWS account.

Common resources and access patterns that may appear in findings include:

• Amazon S3 bucket policies allowing public read, list, or write access
• IAM roles that can be assumed by an external principal or web identity provider
• Resource policies that grant access to another account or organization
• Specific API actions, such as s3:GetObject, that are exposed by a policy

Access Analyzer must be enabled by creating an analyzer in the relevant AWS Region. Findings should be reviewed rather than blindly treated as vulnerabilities. Some cross-account or public access may be intentional, but every finding should have a documented business justification or be remediated.

Analyzer findings can generally be investigated, archived, or resolved. Organizations can also designate a delegated administrator for supported IAM Access Analyzer administration, which helps centralize analysis across accounts.

IAM Credential Report

The IAM credential report is an account-level CSV report covering IAM users and the root account. It provides a point-in-time view of credential configuration and usage.

Useful fields include:

• Whether an IAM user has a console password
• Password creation and last-use information
• Password rotation and next-rotation details, when configured
• Whether an access key exists
• Access key creation date and last-use information
• Whether MFA is enabled
• Whether the root account has MFA configured
• User creation time and credential activity

The report is useful for identifying stale users, unused access keys, missing MFA, and long-lived credentials. It does not replace CloudTrail, IAM Access Analyzer, or an authorization simulation; it primarily describes credential status and usage metadata.

IAM Policy Simulator

The IAM Policy Simulator evaluates the permissions that IAM users, groups, or roles would receive for selected AWS API actions. It is useful when troubleshooting an authorization failure or verifying that a policy grants only the intended operations.

A simulation can test:

• A specific principal
• One or more AWS services
• Individual API actions or all actions for a service
• Resource context and, where applicable, condition context

For example, an S3 policy can be tested against actions such as:

• s3:CreateBucket
• s3:DeleteBucket
• s3:DeleteObject
• s3:GetObject
• s3:ListAllMyBuckets

A result of allowed means the selected policy evaluation permits the action under the supplied simulation context. A result of denied may be caused by an identity policy, resource policy, permissions boundary, session policy, SCP, or another applicable restriction. The simulator is therefore a diagnostic aid, not a substitute for testing the complete production context.

IAM Policy Generation from CloudTrail Activity

IAM can generate a candidate policy for a role by analyzing API activity recorded in CloudTrail. This supports least-privilege refinement by starting from observed behavior instead of granting broad managed policies such as administrator access.

The workflow typically involves:

1. Select the IAM role.
2. Choose policy generation.
3. Specify the observation period.
4. Select the CloudTrail trail and relevant Regions.
5. Review the API actions inferred from the recorded events.
6. Add or remove permissions as necessary.
7. Edit the policy JSON and attach the finalized policy to the role.

Generated policies are recommendations, not authoritative requirements. CloudTrail only shows actions that occurred during the selected period. A role may need permissions for an infrequent workflow, a failure path, a deployment action, or a future feature that was not exercised during analysis.

Exam-Relevant Takeaways

• Enable IAM Access Analyzer before expecting analyzer findings.
• Access Analyzer is primarily concerned with unintended external or public access exposed by resource-based policies.
• A finding is not automatically proof of a security incident. Confirm whether the access is intentional, then archive or remediate it.
• The IAM credential report is the correct tool for reviewing IAM user passwords, access keys, MFA status, and credential activity.
• The Policy Simulator tests whether selected API actions are allowed for a principal under the supplied evaluation context.
• Policy simulation does not grant permissions and does not change live policies.
• Policy generation uses CloudTrail activity to suggest permissions for a role; it does not guarantee complete least-privilege coverage.
• Use observed activity to reduce excessive permissions, but validate the resulting policy against all legitimate application and operational workflows.
• IAM authorization is deny-by-default, and an explicit deny overrides an allow.

Architecture Decision Guide

Requirement	Best-fit IAM tool	Why
Find publicly accessible S3 data	Access Analyzer	Identifies resource policies that expose access outside the intended boundary
Review whether users have MFA or stale access keys	Credential report	Provides account-wide credential configuration and usage metadata
Determine whether a user can call a particular API	Policy Simulator	Evaluates selected actions for a principal
Investigate why an action is denied	Policy Simulator plus policy review	Tests the action and helps isolate effective permissions and explicit denies
Reduce permissions on an active application role	Policy generation from CloudTrail	Uses observed API activity to create a candidate least-privilege policy
Manage analysis across multiple accounts	Access Analyzer with organization/delegated administration features	Centralizes supported analyzer administration and findings review

Common Exam Traps

• Confusing Access Analyzer with the Policy Simulator: Access Analyzer discovers external access in resource policies; the simulator evaluates whether a principal can perform selected actions.
• Treating a credential report as an authorization report: The credential report shows credential state and activity, not the full effective permissions of a user or role.
• Assuming an allowed simulation guarantees success: SCPs, permissions boundaries, session policies, resource policies, condition keys, and runtime context can affect the final authorization result.
• Assuming generated policies are complete: CloudTrail-based generation can miss permissions for workflows that did not run during the selected observation period.
• Assuming every Access Analyzer finding must be removed: Public or cross-account access may be deliberate, such as a public website bucket or a trusted cross-account integration.
• Granting administrator access because policy generation is inconvenient: The correct design is to review observed actions, add justified exceptions, and keep permissions narrowly scoped.
• Forgetting Regional scope: Access Analyzer analyzers and CloudTrail activity selection involve Regions. A finding or generated policy may not represent every Region used by the workload.

Real-World Engineer Notes

• Treat IAM policy generation as an iterative process: observe, generate, review, test, deploy, and monitor.
• Keep CloudTrail enabled for the Regions and accounts that matter. Without relevant management events, policy generation has incomplete evidence.
• Use IAM Access Analyzer findings as part of a recurring security review, especially after changes to S3 bucket policies, KMS key policies, IAM role trust policies, or other resource-based policies.
• Prefer IAM roles and temporary credentials for workloads. Use credential reports to identify remaining long-lived IAM user credentials that should be removed or replaced.
• When diagnosing an authorization problem, inspect both the identity policy and the resource policy. For cross-account access, the caller’s account must allow the action and the resource owner’s policy must trust the caller where required.
• Validate generated policies in a staging environment before attaching them to production roles. Rarely used recovery and deployment paths are common sources of accidental outages.
• Record why intentional public or cross-account findings are accepted. This prevents security teams from repeatedly rediscovering the same approved exposure.

Quick Reference Summary

• Access Analyzer: Finds unintended external, cross-account, or public resource access.
• Credential report: Audits IAM user and root credential configuration, activity, and MFA.
• Policy Simulator: Tests the effective result of selected API actions for a principal.
• Policy generation: Uses CloudTrail events to recommend permissions for a role.
• Least privilege: Generated policies require human review and coverage testing before production use.
• Security principle: Investigate every finding, but distinguish intentional access from excessive access.

Flashcards

1. Q: What is the primary purpose of IAM Access Analyzer?

A: To identify resource-based policies that allow access from outside the intended trust boundary, including public or cross-account access.

1. Q: What must be done before IAM Access Analyzer can produce findings?

A: An analyzer must be created and enabled in the relevant Region.

1. Q: Which IAM tool reports whether users have MFA enabled?

A: The IAM credential report.

1. Q: Does the credential report show all effective permissions for an IAM user?

A: No. It describes credential configuration and usage, not complete authorization.

1. Q: What does the IAM Policy Simulator evaluate?

A: Whether selected API actions would be allowed or denied for a specified IAM principal under the supplied context.

1. Q: Does running the Policy Simulator change an IAM policy?

A: No. It is a read-only evaluation tool.

1. Q: What data does IAM policy generation use?

A: API activity recorded in CloudTrail during a selected time period and for selected Regions.

1. Q: Why might a generated policy be incomplete?

A: Required actions may not have occurred during the observation period, or relevant CloudTrail data may be missing.

1. Q: What takes precedence when an IAM allow and explicit deny both apply?

A: The explicit deny.

1. Q: Should every Access Analyzer finding be deleted or remediated?

A: No. It should be reviewed; intentional access can be documented and archived.

Practice Questions

Question 1

A security team wants to identify S3 buckets whose resource policies allow public access or access from another AWS account. Which AWS tool should they use?

A. IAM Policy Simulator
B. IAM credential report
C. IAM Access Analyzer
D. AWS Cost Explorer

Correct answer: C. IAM Access Analyzer

Explanation: Access Analyzer evaluates resource-based policies and reports external, cross-account, or public access findings. The Policy Simulator evaluates selected actions for principals, while the credential report focuses on IAM credential status.

Question 2

An administrator must determine whether an IAM user can call s3:DeleteObject on a specific bucket without changing any policies. Which approach is most appropriate?

A. Generate a policy from CloudTrail
B. Run the IAM Policy Simulator for the user and action
C. Download the IAM credential report
D. Create an Access Analyzer archive rule

Correct answer: B. Run the IAM Policy Simulator for the user and action

Explanation: The Policy Simulator is designed to test whether a principal is allowed to perform selected API actions. The other options do not directly evaluate the requested authorization decision.

Question 3

A company generated a policy for an application role from 90 days of CloudTrail activity. The application later fails during an infrequent disaster-recovery workflow because an API call is denied. What is the most likely cause?

A. Access Analyzer automatically removed an unused permission
B. The credential report disabled the role
C. The generated policy included only actions observed during the selected period
D. Policy generation always excludes actions from AWS services

Correct answer: C. The generated policy included only actions observed during the selected period

Explanation: CloudTrail-based policy generation produces recommendations from observed API activity. Infrequent recovery, deployment, or maintenance operations may not appear in the selected period and must be reviewed and added deliberately.

Question 4

A company uses an S3 bucket policy to intentionally provide public read access to static website assets. IAM Access Analyzer reports a public-access finding. What should the security team do?

A. Automatically delete the bucket policy
B. Replace the bucket with an IAM user
C. Validate the business requirement, restrict the policy where possible, and document or archive the intentional finding
D. Use the credential report to suppress the finding

Correct answer: C. Validate the business requirement, restrict the policy where possible, and document or archive the intentional finding

Explanation: Access Analyzer findings require review. Public access can be intentional, but the scope should be minimized and the exception documented. Credential reports do not manage resource-policy findings.