AWSConfigRemediation-EnableAccountAccessAnalyzer - Amazon Systems Manager Automation runbook reference
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).



The AWSConfigRemediation-EnableAccountAccessAnalyzer runbook creates an Amazon Identity and Access Management (IAM) Access Analyzer in your Amazon Web Services account. For information about Access Analyzer, see Using Amazon IAM Access Analyzer in the IAM User Guide .

Run this Automation (console)

Document type





Linux, macOS, Windows


  • AnalyzerName

    Type: String

    Description: (Required) The name of the analyzer to create.

  • AutomationAssumeRole

    Type: String

    Allowed values: ^arn:(?:aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[\w+=,.@/-]+$

    Description: (Required) The Amazon Resource Name (ARN) of the Amazon Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.

Required IAM permissions

The AutomationAssumeRole parameter requires the following actions to successfully use the runbook.

  • ssm:StartAutomationExecution

  • ssm:GetAutomationExecution

  • access-analyzer:CreateAnalyzer

  • access-analyzer:GetAnalyzer

Document Steps

  • aws:executeAwsApi - Creates an access analyzer for your account.

  • aws:waitForAwsResourceProperty - Waits for the status of the access analyzer to be ACTIVE .

  • aws:assertAwsResourceProperty - Confirms the status of the access analyzer is ACTIVE .