AWSConfigRemediation-EnableAccountAccessAnalyzer - Amazon Systems Manager Automation Runbook Reference
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

AWSConfigRemediation-EnableAccountAccessAnalyzer

Description

The AWSConfigRemediation-EnableAccountAccessAnalyzer runbook creates an Amazon Identity and Access Management (IAM) Access Analyzer in your Amazon Web Services account. For information about Access Analyzer, see Using Amazon IAM Access Analyzer in the IAM User Guide .

Run this Automation (console)

Document type

Automation

Owner

Amazon

Platforms

Linux, macOS, Windows

Parameters

  • AnalyzerName

    Type: String

    Description: (Required) The name of the analyzer to create.

  • AutomationAssumeRole

    Type: String

    Description: (Required) The Amazon Resource Name (ARN) of the Amazon Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.

Required IAM permissions

The AutomationAssumeRole parameter requires the following actions to use the runbook successfully.

  • ssm:StartAutomationExecution

  • ssm:GetAutomationExecution

  • access-analyzer:CreateAnalyzer

  • access-analyzer:GetAnalyzer

Document Steps

  • aws:executeAwsApi - Creates an access analyzer for your account.

  • aws:waitForAwsResourceProperty - Waits for the status of the access analyzer to be ACTIVE .

  • aws:assertAwsResourceProperty - Confirms the status of the access analyzer is ACTIVE .