Topic starter
02/06/2026 8:49 pm
TL;DR: IAM Access Analyzer surfaces unused roles, keys, passwords, and permissions in AWS, but it does not remove them, leaving remediation to security teams and creating a gap between detection and actual least-privilege enforcement, according to Sonrai Security. The operational bottleneck is not visibility but safe, scalable action.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Why IAM Access Analyzer Tells You About Unused Permissions But Won't Remove Them”.
Key questions
Q: What fails when unused AWS permissions are only detected and not enforced?
A: The control fails at remediation.
Q: Why do unused permissions remain a risk even after teams find them?
A: Because a finding is not a fix.
Q: What do security teams get wrong about unused access cleanup?
A: They often assume a finding backlog can be cleared role by role without breaking production.
Practitioner guidance
- Define an unused-access enforcement path Map which dormant AWS permissions can be blocked centrally, which must remain available, and which require explicit restore approval before they can be re-enabled.
- Separate detection from remediation ownership Assign one team to surface unused access and another to approve and execute revocation so findings do not remain stranded in the review queue.
- Preserve identity structure while revoking privilege Prefer org-level blocking for unused privileged permissions so the role stays intact and restoration does not require re-engineering the identity.
Bottom line: Unused AWS access is a governance problem when teams can see dormant permissions but cannot remove them safely at scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 8:52 pm
Visibility without enforcement is not least privilege: The central lesson here is that discovery tools do not reduce risk unless they are connected to a safe revocation path. Access Analyzer can identify dormant permissions, but the governance burden stays with the team that must decide what to remove and what to preserve. That makes enforcement capacity the real control variable, not the number of findings surfaced.
A few things that frame the scale:
- 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
A question worth separating out:
Q: What is the difference between access visibility and access enforcement?
A: Access visibility tells you what users can do, while access enforcement changes that state in the target systems. A graph can expose effective permissions without being able to remove them, and a governance workflow can revoke access without showing the full entitlement picture. Practitioners need both layers, but they solve different problems.
👉 Read our full editorial: IAM Access Analyzer finds unused access, but enforcement stays manual