Access Analyzer module

To ensure data and cloud infrastructure security, you need to regularly audit the access permissions of users and service accounts.

Access Analyzer is designed for analyzing access permissions of organization subjects for its resources, detecting unused and excessively granted privileges, and running diagnostics of access permissions to reduce information security risks.

RecommendationsRecommendations

Access Analyzer automatically analyzes roles assigned to users and groups for folders, clouds, and organizations and provides, in each individual case, specific recommendations to improve security. The module does not provide recommendations regarding roles assigned to subjects for specific Yandex Cloud service resources, such as virtual machines, service accounts, managed database clusters, etc.

Analysis of roles starts when the Access Analyzer module is enabled in the workspace settings. After that, it runs regularly and automatically. The date and time of the last analysis are displayed on the page with a list of recommendations under the filter bar.

If the Access Analyzer module is disabled in the workspace settings, the recommendation feature is not available.

When running analysis or generating recommendations, Access Analyzer uses system logs of Yandex Identity and Access Management authorizations over the last 90 days.

To view recommendations in the Security Deck UI, users must have the security-deck.viewer role or higher for the workspace.

Roles can be revoked or changed by users holding one of the following roles: admin, resource-manager.admin, organization-manager.admin, resource-manager.clouds.owner, and organization-manager.organizations.owner.

Recommendation typesRecommendation types

Each recommendation suggest performing one of the following actions:

• Replacing the current role with another, more granular role or role group.

  Depending on your situation, the service may suggest one to five roles as a replacement. In this case, the total scope of permissions provided by the new roles is always less than that of the current role.

• Revoking a role from a subject.

  Revoking a role is recommended when permissions provided by the current role of the subject have not been used for authorizing operations in Yandex Cloud during the last 90 days.

If any recommendations do not suit you, you can hide them.

For more information on working with recommendations, see Working with recommendations in the Access Analyzer module.

Access diagnosticsAccess diagnostics

The access diagnostics functionality allows you to view the access permissions assigned to an individual subject (user or service account):

• Directly
• Via a user group
• Via a system group
• Via a public group

For each access permission, the list indicates the name/ID and type of resource to which access was granted, the role assigned to the subject for that resource, and information about whether the role was assigned to the subject directly or was inherited from a group of which the subject is a member.

To check whether access to a particular resource was assigned to a subject directly or via a group, refer to the Group field of the table listing the subject’s access permissions. If the role was assigned directly, this field will be empty. In other cases, it will show the name of the group and its ID.

Access permissions are always assigned to groups directly, so for groups, the Group field of the table with aceess permissions is always empty.

You can filter the list of access permissions granted to a subject by:

• ID of the resource the access was granted to.
• ID of the granted role.
• Assignment method, Directly appointed or Assigned via group.

Only organization members with the organization-manager.viewer role or higher for the organization can view access permissions in the Security Deck interface. In this case you can use access diagnostics even if the Access Analyzer module is not enabled in the workspace settings.

The access diagnostics functionality allows you to revoke excessive access permissions from individual subjects or groups and remove individual subjects from user groups.

To revoke access permissions, users must have one of these roles: admin, resource-manager.admin, organization-manager.admin, resource-manager.clouds.owner, organization-manager.organizations.owner, or the administrator role in the service where they want to revoke the subject's access to a resource.

You can only remove a subject from a group created by an organization administrator. You cannot remove a subject from a system or public group.

Useful linksUseful links

• Working with recommendations in the Access Analyzer module
• Access diagnostics in Access Analyzer

A folder is a logical space where you create and group your Yandex Cloud resources. Just like folders in your file system, Yandex Cloud folders make resource management simpler. For more information, see Folder.

A cloud is an isolated logical space where folders and other Yandex Cloud resources are created. You cannot move resources from one cloud to another. For more information, see Cloud.

An organization is the highest resource in the Yandex Cloud resource model hierarchy that consolidates the resources of all other services. It is also used for user management as well as authentication and authorization management. For more information, see Organization.

In IT system access management, granularity refers to breaking down broad access permissions into distinct, narrow privileges based on the principle of least privilege.