iam-access-analyzer

Deploys an IAM Access Analyzer with optional archive rules for automated finding suppression.

Creates an organization-wide (or account-scoped) IAM Access Analyzer that continuously monitors resource policies for external access. Archive rules suppress known-safe findings automatically. Run in the delegated security account for organization-wide coverage. Requires the governance/organization module to have trusted-access for access-analyzer.amazonaws.com enabled.

Usage

module "access_analyzer" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/identity/iam-access-analyzer/aws"
  version = "0.1.0"

  analyzer_name = "org-access-analyzer"
  type          = "ORGANIZATION"
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_accessanalyzer_analyzer.this	resource
aws_accessanalyzer_archive_rule.this	resource

Inputs

Name	Description	Type	Default	Required
analyzer_name	Name of the IAM Access Analyzer	`string`	`"org-access-analyzer"`	no
archive_rules	Map of archive rule names to filter criteria for auto-archiving findings	map(object({ filter = map(object({ eq = optional(list(string), null) neq = optional(list(string), null) exists = optional(bool, null) contains = optional(list(string), null) })) }))	`{}`	no
tags	Resource tags to apply to all resources	`map(string)`	`{}`	no
type	Analyzer type — ACCOUNT or ORGANIZATION	`string`	`"ORGANIZATION"`	no

Outputs

Name	Description
arn	IAM Access Analyzer ARN
id	IAM Access Analyzer name