Question

A security engineer at a large enterprise must enforce least privilege across 200 AWS accounts in an AWS Organization. Leadership wants an ongoing, automated way to identify IAM roles and users that have permissions they are not actually using (unused access), and to generate refined policies based on observed CloudTrail activity, so that overly broad policies can be tightened. Which approach best meets these requirements with the least custom development?

Accepted Answer

Enable IAM Access Analyzer unused access findings with a delegated administrator account for the organization, and use Access Analyzer policy generation to create least-privilege policies from CloudTrail activity.

Answer

Enable IAM Access Analyzer external access analyzer in each account to detect resources shared outside the organization and manually rewrite the attached identity policies.

Answer

Use the IAM credential report and Access Advisor last-accessed data in each account, then write a Lambda function to parse the reports and email owners about unused permissions.

Answer

Attach a service control policy at the organization root that denies any API action not recorded in the last 90 days of CloudTrail logs.