Inspect who may access a resource — IAM Access Analyzer

Your goal

Create an account access analyzer and label its purpose.

Why this matters

An access analyzer has an explicit scope and a resource identity. You will create an account analyzer, label its purpose, and inspect its settings. This does not prove every access risk has been detected.

Words you will use

An analyzer has a scope for examining supported access policies. ACCOUNT uses an account boundary. An ARN identifies a resource. A tag is a label that helps people recognize its purpose.

How to proceed

Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.

1. Create an account analyzer

Create an ACCOUNT analyzer in your private emulator. An analyzer’s scope matters because it defines which access is considered external. This lab stores the analyzer configuration.

2. Label the analyzer

Save a Purpose tag on its ARN. This makes the resource easier to identify when several security tools are in use. Tags do not change access permissions.

Practice label: This label is saved in the emulator. Use 1–80 characters. Suggested practice value: moonbase.

3. Inspect the scope and label

Get the analyzer and compare its type and tag with the values you saved. This does not prove that all public access has been found or that a policy is safe.

Practice, then check your understanding

Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.

Read the official AWS documentation for service behavior and production details.