AWS IAM: Added note about free Access Analyzer during role manager disable
Summary
Documented AWS-provided Access Analyzer for 90 days when disabling role manager after activating advanced features.
Security assessment
The change promotes security visibility by documenting a tool that helps identify unused permissions and achieve least privilege, though it doesn't fix a specific vulnerability.
Evidence
After you activate advanced features and disable role manager, AWS provides an unused access analyzer at no additional cost for 90 days.
Diff
diff --git a/IAM/latest/UserGuide/id_roles_create_role-manager_least-privilege.md b/IAM/latest/UserGuide/id_roles_create_role-manager_least-privilege.md index 8583fcafc..1950029ee 100644 --- a//IAM/latest/UserGuide/id_roles_create_role-manager_least-privilege.md +++ b//IAM/latest/UserGuide/id_roles_create_role-manager_least-privilege.md @@ -24,0 +25,4 @@ Before disabling role manager, AWS recommends that you use [Using AWS Identity a +###### Note + +If AWS enabled role manager for your account created using the new AWS experience, you don't need to create an analyzer the first time you disable role manager. After you activate advanced features and disable role manager, AWS provides an unused access analyzer at no additional cost for 90 days. The analyzer gives you visibility into unused role permissions and policy scope-down recommendations so you can update the roles that role manager created toward least privilege. +