---
title: IAM Access Analyzer should be enabled in all active regions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM Access Analyzer should be enabled
  in all active regions
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM Access Analyzer should be enabled in all active regions
 
## Description{% #description %}

AWS regions should each have at least one active IAM Access Analyzer with the External Access finding type (analyzer type `ACCOUNT` or `ORGANIZATION`). Analyzers are region-specific, so a region without an active External Access analyzer, or one with only Unused Access analyzers, leaves unintended external access to resources such as S3 buckets, IAM roles, and KMS keys undetected. An `ORGANIZATION` analyzer created in the management or delegated administrator account covers member accounts in the same region.

## Remediation{% #remediation %}

In the [IAM console](https://console.aws.amazon.com/iam/), choose **Access analyzer**, select **Create analyzer**, choose **External access analysis**, confirm the region, and select **Create analyzer**. Repeat for each active region, or use `aws accessanalyzer create-analyzer --analyzer-name <name> --type <ACCOUNT|ORGANIZATION> --region <region_name>` and verify with [list-analyzers](https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/list-analyzers.html) that each region returns at least one `ACTIVE` analyzer.

## References{% #references %}

- [Create an IAM Access Analyzer external access analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-create-external.html)
- [AWS CLI list-analyzers reference](https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/list-analyzers.html)
- [Using AWS IAM Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)