# IAM Access Analyzer API Reference

> AWS Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external, internal, and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external, internal, or unused access, you first need to create an analyzer.

- [Welcome](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/Welcome.md)
- [Common Parameters](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/CommonParameters.md)
- [Common Error Types](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/CommonErrors.md)

## [Actions](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Operations.md)

- [ApplyArchiveRule](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ApplyArchiveRule.md): Retroactively applies the archive rule to existing findings that meet the archive rule criteria.
- [CancelPolicyGeneration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CancelPolicyGeneration.md): Cancels the requested policy generation.
- [CheckAccessNotGranted](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CheckAccessNotGranted.md): Checks whether the specified access isn't allowed by a policy.
- [CheckNoNewAccess](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CheckNoNewAccess.md): Checks whether new access is allowed for an updated policy when compared to the existing policy.
- [CheckNoPublicAccess](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CheckNoPublicAccess.md): Checks whether a resource policy can grant public access to the specified resource type.
- [CreateAccessPreview](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CreateAccessPreview.md): Creates an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions.
- [CreateAnalyzer](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CreateAnalyzer.md): Creates an analyzer for your account.
- [CreateArchiveRule](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CreateArchiveRule.md): Creates an archive rule for the specified analyzer.
- [DeleteAnalyzer](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_DeleteAnalyzer.md): Deletes the specified analyzer.
- [DeleteArchiveRule](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_DeleteArchiveRule.md): Deletes the specified archive rule.
- [GenerateFindingRecommendation](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GenerateFindingRecommendation.md): Creates a recommendation for an unused permissions finding.
- [GetAccessPreview](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetAccessPreview.md): Retrieves information about an access preview for the specified analyzer.
- [GetAnalyzedResource](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetAnalyzedResource.md): Retrieves information about a resource that was analyzed.
- [GetAnalyzer](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetAnalyzer.md): Retrieves information about the specified analyzer.
- [GetArchiveRule](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetArchiveRule.md): Retrieves information about an archive rule.
- [GetFinding](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetFinding.md): Retrieves information about the specified finding.
- [GetFindingRecommendation](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetFindingRecommendation.md): Retrieves information about a finding recommendation for the specified analyzer.
- [GetFindingsStatistics](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetFindingsStatistics.md): Retrieves a list of aggregated finding statistics for an external access or unused access analyzer.
- [GetFindingV2](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetFindingV2.md): Retrieves information about the specified finding.
- [GetGeneratedPolicy](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetGeneratedPolicy.md): Retrieves the policy that was generated using StartPolicyGeneration.
- [ListAccessPreviewFindings](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAccessPreviewFindings.md): Retrieves a list of access preview findings generated by the specified access preview.
- [ListAccessPreviews](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAccessPreviews.md): Retrieves a list of access previews for the specified analyzer.
- [ListAnalyzedResources](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAnalyzedResources.md): Retrieves a list of resources of the specified type that have been analyzed by the specified analyzer.
- [ListAnalyzers](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAnalyzers.md): Retrieves a list of analyzers.
- [ListArchiveRules](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListArchiveRules.md): Retrieves a list of archive rules created for the specified analyzer.
- [ListFindings](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListFindings.md): Retrieves a list of findings generated by the specified analyzer.
- [ListFindingsV2](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListFindingsV2.md): Retrieves a list of findings generated by the specified analyzer.
- [ListPolicyGenerations](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListPolicyGenerations.md): Lists all of the policy generations requested in the last seven days.
- [ListTagsForResource](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListTagsForResource.md): Retrieves a list of tags applied to the specified resource.
- [StartPolicyGeneration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_StartPolicyGeneration.md): Starts the policy generation request.
- [StartResourceScan](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_StartResourceScan.md): Immediately starts a scan of the policies applied to the specified resource.
- [TagResource](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_TagResource.md): Adds a tag to the specified resource.
- [UntagResource](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UntagResource.md): Removes a tag from the specified resource.
- [UpdateAnalyzer](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UpdateAnalyzer.md): Modifies the configuration of an existing analyzer.
- [UpdateArchiveRule](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UpdateArchiveRule.md): Updates the criteria and values for the specified archive rule.
- [UpdateFindings](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UpdateFindings.md): Updates the status for the specified findings.
- [ValidatePolicy](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ValidatePolicy.md): Requests the validation of a policy and returns a list of findings.


## [Data Types](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Types.md)

- [Access](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Access.md): Contains information about actions and resources that define permissions to check against a policy.
- [AccessPreview](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AccessPreview.md): Contains information about an access preview.
- [AccessPreviewFinding](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AccessPreviewFinding.md): An access preview finding generated by the access preview.
- [AccessPreviewStatusReason](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AccessPreviewStatusReason.md): Provides more details about the current status of the access preview.
- [AccessPreviewSummary](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AccessPreviewSummary.md): Contains a summary of information about an access preview.
- [AclGrantee](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AclGrantee.md): You specify each grantee as a type-value pair using one of these types.
- [AnalysisRule](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AnalysisRule.md): Contains information about analysis rules for the analyzer.
- [AnalysisRuleCriteria](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AnalysisRuleCriteria.md): The criteria for an analysis rule for an analyzer.
- [AnalyzedResource](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AnalyzedResource.md): Contains details about the analyzed resource.
- [AnalyzedResourceSummary](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AnalyzedResourceSummary.md): Contains the ARN of the analyzed resource.
- [AnalyzerConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AnalyzerConfiguration.md): Contains information about the configuration of an analyzer for an AWS organization or account.
- [AnalyzerSummary](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_AnalyzerSummary.md): Contains information about the analyzer.
- [ArchiveRuleSummary](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ArchiveRuleSummary.md): Contains information about an archive rule.
- [CloudTrailDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CloudTrailDetails.md): Contains information about CloudTrail access.
- [CloudTrailProperties](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CloudTrailProperties.md): Contains information about CloudTrail access.
- [Configuration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Configuration.md): Access control configuration structures for your resource.
- [Criterion](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Criterion.md): The criteria to use in the filter that defines the archive rule.
- [DynamodbStreamConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_DynamodbStreamConfiguration.md): The proposed access control configuration for a DynamoDB stream.
- [DynamodbTableConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_DynamodbTableConfiguration.md): The proposed access control configuration for a DynamoDB table or index.
- [EbsSnapshotConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_EbsSnapshotConfiguration.md): The proposed access control configuration for an Amazon EBS volume snapshot.
- [EcrRepositoryConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_EcrRepositoryConfiguration.md): The proposed access control configuration for an Amazon ECR repository.
- [EfsFileSystemConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_EfsFileSystemConfiguration.md): The proposed access control configuration for an Amazon EFS file system.
- [ExternalAccessDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ExternalAccessDetails.md): Contains information about an external access finding.
- [ExternalAccessFindingsStatistics](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ExternalAccessFindingsStatistics.md): Provides aggregate statistics about the findings for the specified external access analyzer.
- [Finding](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Finding.md): Contains information about a finding.
- [FindingAggregationAccountDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_FindingAggregationAccountDetails.md): Contains information about the findings for an AWS account in an organization unused access analyzer.
- [FindingDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_FindingDetails.md): Contains information about an external access or unused access finding.
- [FindingSource](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_FindingSource.md): The source of the finding.
- [FindingSourceDetail](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_FindingSourceDetail.md): Includes details about how the access that generated the finding is granted.
- [FindingsStatistics](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_FindingsStatistics.md): Contains information about the aggregate statistics for an external or unused access analyzer.
- [FindingSummary](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_FindingSummary.md): Contains information about a finding.
- [FindingSummaryV2](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_FindingSummaryV2.md): Contains information about a finding.
- [GeneratedPolicy](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GeneratedPolicy.md): Contains the text for the generated policy.
- [GeneratedPolicyProperties](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GeneratedPolicyProperties.md): Contains the generated policy details.
- [GeneratedPolicyResult](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GeneratedPolicyResult.md): Contains the text for the generated policy and its details.
- [IamRoleConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_IamRoleConfiguration.md): The proposed access control configuration for an IAM role.
- [InlineArchiveRule](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_InlineArchiveRule.md): An criterion statement in an archive rule.
- [InternalAccessAnalysisRule](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_InternalAccessAnalysisRule.md): Contains information about analysis rules for the internal access analyzer.
- [InternalAccessAnalysisRuleCriteria](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_InternalAccessAnalysisRuleCriteria.md): The criteria for an analysis rule for an internal access analyzer.
- [InternalAccessConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_InternalAccessConfiguration.md): Specifies the configuration of an internal access analyzer for an AWS organization or account.
- [InternalAccessDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_InternalAccessDetails.md): Contains information about an internal access finding.
- [InternalAccessFindingsStatistics](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_InternalAccessFindingsStatistics.md): Provides aggregate statistics about the findings for the specified internal access analyzer.
- [InternalAccessResourceTypeDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_InternalAccessResourceTypeDetails.md): Contains information about the total number of active, archived, and resolved findings for a resource type of an internal access analyzer.
- [InternetConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_InternetConfiguration.md): This configuration sets the network origin for the Amazon S3 access point or multi-region access point to Internet.
- [JobDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_JobDetails.md): Contains details about the policy generation request.
- [JobError](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_JobError.md): Contains the details about the policy generation error.
- [KmsGrantConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_KmsGrantConfiguration.md): A proposed grant configuration for a KMS key.
- [KmsGrantConstraints](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_KmsGrantConstraints.md): Use this structure to propose allowing cryptographic operations in the grant only when the operation request includes the specified encryption context.
- [KmsKeyConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_KmsKeyConfiguration.md): Proposed access control configuration for a KMS key.
- [Location](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Location.md): A location in a policy that is represented as a path through the JSON representation and a corresponding span.
- [NetworkOriginConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_NetworkOriginConfiguration.md): The proposed InternetConfiguration or VpcConfiguration to apply to the Amazon S3 access point.
- [PathElement](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_PathElement.md): A single element in a path through the JSON representation of a policy.
- [PolicyGeneration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_PolicyGeneration.md): Contains details about the policy generation status and properties.
- [PolicyGenerationDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_PolicyGenerationDetails.md): Contains the ARN details about the IAM entity for which the policy is generated.
- [Position](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Position.md): A position in a policy.
- [RdsDbClusterSnapshotAttributeValue](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_RdsDbClusterSnapshotAttributeValue.md): The values for a manual Amazon RDS DB cluster snapshot attribute.
- [RdsDbClusterSnapshotConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_RdsDbClusterSnapshotConfiguration.md): The proposed access control configuration for an Amazon RDS DB cluster snapshot.
- [RdsDbSnapshotAttributeValue](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_RdsDbSnapshotAttributeValue.md): The name and values of a manual Amazon RDS DB snapshot attribute.
- [RdsDbSnapshotConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_RdsDbSnapshotConfiguration.md): The proposed access control configuration for an Amazon RDS DB snapshot.
- [ReasonSummary](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ReasonSummary.md): Contains information about the reasoning why a check for access passed or failed.
- [RecommendationError](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_RecommendationError.md): Contains information about the reason that the retrieval of a recommendation for a finding failed.
- [RecommendedStep](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_RecommendedStep.md): Contains information about a recommended step for an unused access analyzer finding.
- [ResourceTypeDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ResourceTypeDetails.md): Contains information about the total number of active cross-account and public findings for a resource type of an external access analyzer.
- [S3AccessPointConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_S3AccessPointConfiguration.md): The configuration for an Amazon S3 access point or multi-region access point for the bucket.
- [S3BucketAclGrantConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_S3BucketAclGrantConfiguration.md): A proposed access control list grant configuration for an Amazon S3 bucket.
- [S3BucketConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_S3BucketConfiguration.md): Proposed access control configuration for an Amazon S3 bucket.
- [S3ExpressDirectoryAccessPointConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_S3ExpressDirectoryAccessPointConfiguration.md): Proposed configuration for an access point attached to an Amazon S3 directory bucket.
- [S3ExpressDirectoryBucketConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_S3ExpressDirectoryBucketConfiguration.md): Proposed access control configuration for an Amazon S3 directory bucket.
- [S3PublicAccessBlockConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_S3PublicAccessBlockConfiguration.md): The PublicAccessBlock configuration to apply to this Amazon S3 bucket.
- [SecretsManagerSecretConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_SecretsManagerSecretConfiguration.md): The configuration for a Secrets Manager secret.
- [SnsTopicConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_SnsTopicConfiguration.md): The proposed access control configuration for an Amazon SNS topic.
- [SortCriteria](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_SortCriteria.md): The criteria used to sort.
- [Span](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Span.md): A span in a policy.
- [SqsQueueConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_SqsQueueConfiguration.md): The proposed access control configuration for an Amazon SQS queue.
- [StatusReason](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_StatusReason.md): Provides more details about the current status of the analyzer.
- [Substring](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Substring.md): A reference to a substring of a literal string in a JSON document.
- [Trail](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_Trail.md): Contains details about the CloudTrail trail being analyzed to generate a policy.
- [TrailProperties](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_TrailProperties.md): Contains details about the CloudTrail trail being analyzed to generate a policy.
- [UnusedAccessConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UnusedAccessConfiguration.md): Contains information about an unused access analyzer.
- [UnusedAccessFindingsStatistics](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UnusedAccessFindingsStatistics.md): Provides aggregate statistics about the findings for the specified unused access analyzer.
- [UnusedAccessTypeStatistics](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UnusedAccessTypeStatistics.md): Contains information about the total number of findings for a type of unused access.
- [UnusedAction](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UnusedAction.md): Contains information about an unused access finding for an action.
- [UnusedIamRoleDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UnusedIamRoleDetails.md): Contains information about an unused access finding for an IAM role.
- [UnusedIamUserAccessKeyDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UnusedIamUserAccessKeyDetails.md): Contains information about an unused access finding for an IAM user access key.
- [UnusedIamUserPasswordDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UnusedIamUserPasswordDetails.md): Contains information about an unused access finding for an IAM user password.
- [UnusedPermissionDetails](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UnusedPermissionDetails.md): Contains information about an unused access finding for a permission.
- [UnusedPermissionsRecommendedStep](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UnusedPermissionsRecommendedStep.md): Contains information about the action to take for a policy in an unused permissions finding.
- [ValidatePolicyFinding](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ValidatePolicyFinding.md): A finding in a policy.
- [ValidationExceptionField](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ValidationExceptionField.md): Contains information about a validation exception.
- [VpcConfiguration](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_VpcConfiguration.md): The proposed virtual private cloud (VPC) configuration for the Amazon S3 access point.


## Full content

The entire guide is also available as a single markdown file, useful for feeding the full guide to an LLM in one pass:

- [Complete guide (single file)](https://docs.aws.amazon.com/access-analyzer/latest/APIReference/full.md)