{
  "Provider": "aws",
  "CheckID": "accessanalyzer_enabled_without_findings",
  "CheckTitle": "Check if IAM Access Analyzer is enabled without findings",
  "CheckType": ["IAM"],
  "ServiceName": "accessanalyzer",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:access-analyzer:region:account-id:analyzer/resource-id",
  "Severity": "low",
  "ResourceType": "Other",
  "Description": "Check if IAM Access Analyzer is enabled without findings",
  "Risk": "AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data, which is a security risk. IAM Access Analyzer uses a form of mathematical analysis called automated reasoning, which applies logic and mathematical inference to determine all possible access paths allowed by a resource policy.",
  "RelatedUrl": "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html",
  "Remediation": {
    "Code": {
      "CLI": "aws accessanalyzer create-analyzer --analyzer-name <NAME> --type <ACCOUNT|ORGANIZATION>",
      "NativeIaC": "",
      "Other": "",
      "Terraform": ""
    },
    "Recommendation": {
      "Text": "Enable IAM Access Analyzer for all accounts, create analyzer and take action over it is recommendations (IAM Access Analyzer is available at no additional cost).",
      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html"
    }
  },
  "Categories": [],
  "Tags": {
    "Tag1Key": "value",
    "Tag2Key": "value"
  },
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": "",
  "Compliance": [
    {
      "Framework": "CIS-AWS",
      "Version": "1.4",
      "Control": [ "1.20" ],
      "Group": [ "level1" ]
    }
  ]
}
