Working with recommendations in the Access Analyzer module
Note
The Access Analyzer module identifies unused and excessively granted privileges and provides recommendations for replacing or revoking excessive roles. If any recommendations do not suit you, you can hide them.
Recommendations can be accepted by users holding one of the following roles: admin, resource-manager.admin, organization-manager.admin, resource-manager.clouds.owner, organization-manager.organizations.owner.
To use the recommendation functionality, enable the Access Analyzer module in the workspace settings.
Alert
Any recommendations regarding the revocation or modification of role compositions provided by the Access Analyzer module are general in nature and may ignore the specifics of your products and infrastructure.
Independently analyze any recommendations provided by the module. By accepting a recommendation, you assume the risk of potential consequences that may arise from implementing the proposed changes.
View recommendations
To view recommendations in the Security Deck UI, users must have the security-deck.viewer role or higher for the workspace.
To view Access Analyzer recommendations:
- Log in to Yandex Security Deck.
- Ensure that the Access Analyzer module is enabled in your workspace.
- On the left panel, select Access Analyzer, and at the top of the screen, select the workspace.
- Navigate to the Recommendations tab.
This will open a page with a list of Access Analyzer recommendations. At the top of the screen, there is a filter bar that allows you to select recommendations based on type, subjects being checked, monitored resources and roles, as well as the specified visibility.
The date and time of the last analysis are displayed below the filter bar.
The list of recommendations contains the following fields:
-
Subject: Name and type of the subject to which the recommendation was issued.
A subject can be a user, service account, user group, as well as system or public group.
-
Resource: Name and type of the resource for which the access recommendation has been issued.
A resource can be a folder, cloud, or organization. Access Analyzer does not provide recommendations regarding roles assigned to subjects for specific Yandex Cloud service resources, such as virtual machines, service accounts, managed database clusters, etc.
-
Current role: Role assigned to a subject for a resource, and regarding which Access Analyzer has issued a recommendation.
-
Recommendation: Recommended action: replace or revoke the current role.
If it is recommended to replace the role, this field also displays a list (of up to five) of new roles that will be assigned to the subject as a result of the replacement.
Managing recommendation visibility
You can manage the visibility of recommendations to hide those that do not suit you from the list.
Hiding a recommendation
-
Open the list of Access Analyzer recommendations.
-
Make sure Access via OS Login using SSH certificates (recommended) is selected in the filter bar.
-
In the row containing the recommendation you want to hide, click and select Hide recommendation.
As a result, the recommendation will be hidden from the list of active recommendations and will appear in the list of hidden recommendations.
Restoring a recommendation
-
Open the list of Access Analyzer recommendations.
-
In the filter bar at the top of the screen, select
Hidden. -
In the row containing the recommendation you want to return to the active list, click and select Restore to active.
As a result, the recommendation will be removed from the list of hidden recommendations and will reappear in the list of active recommendations.
Replacing a role
To accept the recommendation to replace a role:
-
Open the list of Access Analyzer recommendations.
-
In the row containing the recommendation to replace the role you want to accept, click and select Replace role.
In the window that opens, review the details of the proposed replacement and, if you agree, click Save.
As a result, the initial role assigned to the subject for the resource will be replaced by a new role or set of roles for that same resource.
Revoking a role
To accept the recommendation to revoke a role:
-
Open the list of Access Analyzer recommendations.
-
In the row containing the recommendation to revoke the role you want to accept, click and select Revoke role.
In the window that opens, review the details of the proposed action and, if you agree, click Revoke.
As a result, the role assigned to the subject for the resource will be revoked.
Useful links
A folder is a logical space where you create and group your Yandex Cloud resources. Just like folders in your file system, Yandex Cloud folders make resource management simpler. For more information, see Folder.
A cloud is an isolated logical space where folders and other Yandex Cloud resources are created. You cannot move resources from one cloud to another. For more information, see Cloud.
An organization is the highest resource in the Yandex Cloud resource model hierarchy that consolidates the resources of all other services. It is also used for user management as well as authentication and authorization management. For more information, see Organization.