IAM Access Analyzer Lied to Us: The $1,000/Month Overprovisioning Mistake

A month ago, we thought we'd solved our access control issues with IAM Access Analyzer. But a closer look revealed a staggering overprovisioning problem that's been quietly draining our budget. Here's the shocking truth and how we fixed it.

Introduction to IAM Access Analyzer

IAM Access Analyzer is a tool that helps you identify and manage access to your AWS resources. It provides a simple and intuitive way to analyze and optimize your IAM policies. However, as we soon discovered, its supposed simplicity can be misleading.

import { ListPoliciesCommand } from '@aws-sdk/client-iam';

const iamClient = new IAMClient({ region: 'us-east-1' });