AWS Access Analyzer Weekly Digest
Deploys Access Analyzer with an EventBridge rule triggering a Lambda that emails a formatted weekly digest of all external access findings.
AWS Access Analyzer Weekly Digest
AWS IAM Access Analyzer continuously scans your account for resources that are shared with external principals — but findings pile up silently in the console. This stack adds a weekly digest that emails a clean summary of all active findings every Monday morning, so your team stays on top of external access without living in the console.
What Gets Deployed
- IAM Access Analyzer — account-level analyzer covering S3 buckets, IAM roles, KMS keys, Lambda functions, SQS queues, Secrets Manager secrets, and SNS topics
- EventBridge Scheduled Rule — fires every Monday at 8:00 AM UTC (configurable timezone offset via parameter)
- Digest Lambda — Python 3.12 function that calls the Access Analyzer API, groups findings by resource type and severity, and renders a formatted HTML + plain-text email
- SES Email Delivery — sends to a configurable list of recipients; includes unsubscribe instructions and a direct link to the finding in the AWS console for each item
Email Digest Format
The digest groups findings into three sections: Critical (public access), High (cross-account access from outside your org), and Informational (cross-account access within your org). Each finding shows the resource ARN, external principal, access level (read/write/admin), and days since first detected.
What You Get
access-analyzer-digest.yaml— CloudFormation templatedigest-lambda/— Python Lambda with unit tests and the HTML email templateREADME.md— deployment guide, SES setup, and customizing the digest schedule
Requirements
SES must be configured with a verified sender domain. If SES is in sandbox, recipient addresses must also be verified. Multi-account support available via AWS Organizations delegated administrator setup (instructions in README).