# iam-access-analyzer

Deploys an IAM Access Analyzer with optional archive rules for automated finding suppression.

Creates an organization-wide (or account-scoped) IAM Access Analyzer that continuously monitors resource policies for external access. Archive rules suppress known-safe findings automatically. Run in the delegated security account for organization-wide coverage. Requires the `governance/organization` module to have trusted-access for `access-analyzer.amazonaws.com` enabled.

## Usage

```hcl
module "access_analyzer" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/identity/iam-access-analyzer/aws"
  version = "0.1.0"

  analyzer_name = "org-access-analyzer"
  type          = "ORGANIZATION"
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_accessanalyzer_analyzer.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/accessanalyzer_analyzer) | resource |
| [aws_accessanalyzer_archive_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/accessanalyzer_archive_rule) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_analyzer_name"></a> [analyzer_name](#input_analyzer_name) | Name of the IAM Access Analyzer | `string` | `"org-access-analyzer"` | no |
| <a name="input_archive_rules"></a> [archive_rules](#input_archive_rules) | Map of archive rule names to filter criteria for auto-archiving findings | <pre>map(object({<br/>    filter = map(object({<br/>      eq       = optional(list(string), null)<br/>      neq      = optional(list(string), null)<br/>      exists   = optional(bool, null)<br/>      contains = optional(list(string), null)<br/>    }))<br/>  }))</pre> | `{}` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |
| <a name="input_type"></a> [type](#input_type) | Analyzer type — ACCOUNT or ORGANIZATION | `string` | `"ORGANIZATION"` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_arn"></a> [arn](#output_arn) | IAM Access Analyzer ARN |
| <a name="output_id"></a> [id](#output_id) | IAM Access Analyzer name |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->