Check IAM Access Analyzer in All Regions and List Findings

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReportAnalyzersAndFindings",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "access-analyzer:ListAnalyzers",
        "access-analyzer:ListFindings"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CreateExternalAnalyzerOnlyWithApply",
      "Effect": "Allow",
      "Action": "access-analyzer:CreateAnalyzer",
      "Resource": "arn:aws:access-analyzer:*:*:analyzer/account-external-access"
    },
    {
      "Sid": "AccessAnalyzerServiceLinkedRole",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer",
      "Condition": { "StringEquals": { "iam:AWSServiceName": "access-analyzer.amazonaws.com" } }
    }
  ]
}

// check-iam-access-analyzer-all-regions.ts
// Lists IAM Access Analyzer analyzers in every enabled Region (external, internal and unused access),
// summarizes ACTIVE findings per analyzer, and flags Regions with no external access analyzer.
// Changes nothing unless you pass --apply, which creates a free account-level external access analyzer
// in each Region that has none.
// Usage: npx tsx check-iam-access-analyzer-all-regions.ts [--regions=us-east-1,eu-west-1] [--apply]
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import {
  AccessAnalyzerClient,
  CreateAnalyzerCommand,
  paginateListAnalyzers,
  paginateListFindingsV2,
} from "@aws-sdk/client-accessanalyzer";
import type { AnalyzerSummary, Criterion } from "@aws-sdk/client-accessanalyzer";

const args = process.argv.slice(2);
const apply = args.includes("--apply");
const regionArg = args.find((a) => a.startsWith("--regions="))?.split("=")[1];
const EXTERNAL = new Set(["ACCOUNT", "ORGANIZATION"]);

interface AnalyzerRow {
  Region: string;
  Analyzer: string;
  Type: string;
  Status: string;
  ActiveFindings: number;
  Public: number | string;
  TopTypes: string;
}

async function listRegions(): Promise<string[]> {
  if (regionArg) return regionArg.split(",").map((r) => r.trim()).filter(Boolean);
  const out = await new EC2Client({}).send(new DescribeRegionsCommand({})); // enabled Regions only
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

async function analyzersIn(client: AccessAnalyzerClient): Promise<AnalyzerSummary[]> {
  const all: AnalyzerSummary[] = [];
  for await (const page of paginateListAnalyzers({ client }, {})) all.push(...(page.analyzers ?? []));
  return all;
}

// Counts ACTIVE findings, grouped by resource type (external/internal) or finding type (unused access).
async function summarize(client: AccessAnalyzerClient, analyzer: AnalyzerSummary) {
  const filter: Record<string, Criterion> = { status: { eq: ["ACTIVE"] } };
  const byKey = new Map<string, number>();
  let total = 0;
  for await (const page of paginateListFindingsV2({ client }, { analyzerArn: analyzer.arn, filter })) {
    for (const f of page.findings ?? []) {
      const key = (analyzer.type ?? "").includes("UNUSED") ? f.findingType ?? "?" : f.resourceType ?? "?";
      byKey.set(key, (byKey.get(key) ?? 0) + 1);
      total++;
    }
  }
  let publicCount: number | string = "-";
  if (EXTERNAL.has(analyzer.type ?? "") && total > 0) {
    publicCount = 0;
    const publicFilter: Record<string, Criterion> = { ...filter, isPublic: { eq: ["true"] } };
    for await (const page of paginateListFindingsV2({ client }, { analyzerArn: analyzer.arn, filter: publicFilter })) {
      publicCount += page.findings?.length ?? 0;
    }
  }
  const top = [...byKey.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([k, n]) => `${k} ${n}`).join(", ");
  return { total, publicCount, top: top || "-" };
}

async function main(): Promise<void> {
  const regions = await listRegions();
  const rows: AnalyzerRow[] = [];
  const noExternal: string[] = [];
  let unusedSeen = false;

  for (const region of regions) {
    const client = new AccessAnalyzerClient({ region });
    let analyzers: AnalyzerSummary[];
    try {
      analyzers = await analyzersIn(client);
    } catch (err) {
      rows.push({ Region: region, Analyzer: `ERROR ${err instanceof Error ? err.name : err}`, Type: "", Status: "", ActiveFindings: 0, Public: "", TopTypes: "" });
      continue;
    }
    if (!analyzers.some((a) => EXTERNAL.has(a.type ?? "") && a.status === "ACTIVE")) noExternal.push(region);
    if (analyzers.some((a) => (a.type ?? "").includes("UNUSED"))) unusedSeen = true;
    for (const a of analyzers) {
      const s = a.status === "ACTIVE" ? await summarize(client, a) : { total: 0, publicCount: "-", top: a.statusReason?.code ?? "-" };
      rows.push({ Region: region, Analyzer: a.name ?? "?", Type: a.type ?? "?", Status: a.status ?? "?", ActiveFindings: s.total, Public: s.publicCount, TopTypes: s.top });
    }
  }

  console.table(rows);
  console.log(`External access analyzer missing in ${noExternal.length} of ${regions.length} Regions: ${noExternal.join(", ") || "none"}`);
  if (!unusedSeen) console.log("No unused access analyzer found (one per account or organization covers all Regions; it is a paid feature).");

  if (apply && noExternal.length) {
    for (const region of noExternal) {
      try {
        const out = await new AccessAnalyzerClient({ region }).send(new CreateAnalyzerCommand({
          analyzerName: "account-external-access",
          type: "ACCOUNT",
        }));
        console.log(`Created ${out.arn}`);
      } catch (err) {
        console.error(`Could not create an analyzer in ${region}: ${err instanceof Error ? `${err.name} ${err.message}` : err}`);
        process.exitCode = 1;
      }
    }
  } else if (noExternal.length) {
    console.log("Run again with --apply to create an account-level external access analyzer in those Regions.");
    process.exitCode = 2;
  }
}

main().catch((err) => {
  console.error(err instanceof Error ? `${err.name}: ${err.message}` : err);
  process.exit(1);
});

npm install @aws-sdk/client-accessanalyzer @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Report every enabled Region
AWS_PROFILE=security-audit npx tsx check-iam-access-analyzer-all-regions.ts

# Create the free external access analyzer where it's missing
AWS_PROFILE=security-admin npx tsx check-iam-access-analyzer-all-regions.ts --apply

┌─────────┬─────────────┬─────────────────────────────────────┬─────────────────────────┬──────────┬────────────────┬────────┬──────────────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Analyzer                            │ Type                    │ Status   │ ActiveFindings │ Public │ TopTypes                                                         │
├─────────┼─────────────┼─────────────────────────────────────┼─────────────────────────┼──────────┼────────────────┼────────┼──────────────────────────────────────────────────────────────────┤
│ 0       │ 'eu-west-1' │ 'ExternalAccess-ConsoleAnalyzer-eu' │ 'ACCOUNT'               │ 'ACTIVE' │ 3              │ 0      │ 'AWS::IAM::Role 2, AWS::KMS::Key 1'                              │
│ 1       │ 'us-east-1' │ 'ExternalAccess-ConsoleAnalyzer'    │ 'ACCOUNT'               │ 'ACTIVE' │ 9              │ 2      │ 'AWS::S3::Bucket 4, AWS::IAM::Role 3, AWS::SQS::Queue 2'         │
│ 2       │ 'us-east-1' │ 'unused-access-90d'                 │ 'ACCOUNT_UNUSED_ACCESS' │ 'ACTIVE' │ 27             │ '-'    │ 'UnusedPermission 14, UnusedIAMRole 9, UnusedIAMUserAccessKey 4' │
└─────────┴─────────────┴─────────────────────────────────────┴─────────────────────────┴──────────┴────────────────┴────────┴──────────────────────────────────────────────────────────────────┘
External access analyzer missing in 2 of 4 Regions: eu-central-1, us-west-2
Run again with --apply to create an account-level external access analyzer in those Regions.