Resource Access Management:Detect over-privileged identities

How it works

The analyzer works by consuming data from RAM Access Auditing, which tracks the permissions granted to an identity and when those permissions were last used. Based on this data and a configurable time window, the analyzer generates findings that are categorized into the following types:

• Super administrator: The identity has full administrative privileges (such as the AdministratorAccess policy is attached), granting unrestricted access to all resources in the account.

• Privileged user or role: The identity has permissions to perform high-risk operations that could lead to privilege escalation, such as changing permission policies or creating AccessKey pairs for other users. For a complete list, see the "Appendix: High-risk privileges" section in this topic.

• Inactive user or role: The identity has not used any of its permissions to access any service within the configured time window for unused access.

• Over-privileged user or role: The identity has one or more permissions that have not been used within the configured time window for unused access.

Create an over-privileged identity analyzer

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Access Analysis > Analyzers.

3. On the Analyzers page, click Create Analyzer.

4. On the Create Analyzer page, configure the following parameters:

   • Analyzer Type: Select Over-privileged Access.

     Analyzer Name: Enter a descriptive name for your analyzer.

   • Unused Access Age: Specify the number of days (1-180) an unused permission should be considered inactive. The default is 90 days.

   • Analyzer Scope: Choose to analyze the Current Account or your entire Resource Directory.

     Note

     The Resource Directory option is only available to the management account

   

5. Click Create Analyzer.

After creation, the analyzer begins to evaluate your resources. It may take some time before the initial findings are generated.

View and manage findings

You can view findings on the Analyzers page for a dashboard overview or on the Findings page for a detailed, filterable list.

Appendix: High-risk privileges

The following table lists the specific high-risk actions that will trigger a "Privileged User" or "Privileged Role" finding.