Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11To find potentially unused permissions on an AWS Lambda function, inspect its execution role with an IAM Access Analyzer Unused access analyzer, then check IAM last-accessed data and CloudTrail before changing the role’s policies. These tools reveal different parts of the picture: an access record can be a denied attempt, and gaps in telemetry do not prove a permission is safe to remove.
Start with the Lambda execution role
A Lambda function uses its execution role when it accesses AWS services. Find the role assigned to the function, then review the role’s identity-based policies—the permissions attached directly to it or through groups are not the focus here; Access Analyzer evaluates identity-based policies attached to IAM roles. A function may have more than one policy contributing permissions, so consider all policies attached to the role rather than treating one policy as the whole permission set. AWS: Using IAM Access Analyzer findings
As an Amazon Associate I earn from qualifying purchases.
Choose the right AWS analysis
Use both unused-access findings and CloudTrail-based policy generation as complementary checks. They answer different questions and have different lookback limits.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Tool | What it helps answer | Lookback and evidence | Important limits |
|---|---|---|---|
| IAM Access Analyzer: Unused access | Which role permissions appear unused during the selected tracking period? | Choose a period from 1 to 365 days. Findings can be at service level and, where supported, action level. | Only roles and permissions present for the entire selected period are evaluated; service-linked roles are excluded. AWS findings documentation and AWS Access Analyzer overview |
| IAM last-accessed information | Which services or supported actions show recorded activity? | Service-level data and action-level data for supported actions. Recent activity appears in the IAM console within four hours, according to AWS. Lambda action tracking began April 7, 2021. | Not all actions or access paths are represented; activity can include denied attempts. AWS: Last accessed information and AWS: IAM last accessed information |
| IAM Access Analyzer policy generation | What policy template can be derived from a role’s CloudTrail activity? | Analyze CloudTrail events over a selected period of up to 90 days. | Depending on service support, the template may list only services rather than specific actions. It can include attempted, denied actions and omits data-event action detail and iam:PassRole. Treat it as a starting template, not a ready-to-attach replacement. AWS: Policy generation |
Create an unused-access analyzer
- Open the IAM console and go to Access Analyzer.
- Create an analyzer and choose Unused access. An analyzer created for external or internal access is a different analysis and does not provide unused-access findings. AWS: Access Analyzer overview
- Set the analyzer scope to the AWS account or organization you intend to assess.
- Choose a tracking period from 1 through 365 days. Choose a period that covers the function’s normal work, including scheduled or infrequent jobs. The analyzer evaluates only roles and permissions that existed for the full selected period; a newly attached permission cannot be assessed against activity from before it existed. AWS: Findings and AWS: Analyzer configuration
- Review findings for the Lambda execution role. Findings can identify services and, where AWS supports action-level data, individual actions. Service-linked roles are excluded from unused-access analysis. AWS: Findings
Check last-accessed data and CloudTrail
Use last-accessed data to narrow candidates
In IAM, inspect the role’s last-accessed information to see recorded activity by service and, for supported actions, by action. AWS says recent activity can take up to four hours to appear in the IAM console. The history is finite: AWS documents at least 400 days of history depending on the service, and Lambda action tracking began April 7, 2021. A permission with no record in the available window may still be needed for a less frequent workload or an access path the report does not cover. AWS: IAM last accessed information
#1 Best Overall
Use CloudTrail to verify what happened
Check relevant CloudTrail events for candidate permissions and their outcomes. AWS identifies CloudTrail as the authoritative source for API calls and whether they succeeded or were denied. This distinction matters because last-accessed information can reflect an attempted request, including one that was denied—not successful use. AWS: Last accessed information and CloudTrail
Policy generation provides another CloudTrail-based view: it can analyze events over up to 90 days and produce a policy template for a role. Depending on service support, the template may show only recently used services rather than the actions, so an operator may need to add actions. AWS also notes that generated policies may include denied attempts. Review and tailor the template instead of attaching it unchanged. AWS: Policy generation
Quick Recap
Best Value
Account for the blind spots before removing anything
- Data-plane events: IAM action last-accessed information is not available for data-plane events. Policy generation also does not identify action-level activity for data events. A quiet action report therefore cannot establish that data-plane permissions are unused. AWS: Last accessed information and AWS: Policy generation
iam:PassRole: This action is not tracked in last-accessed information and is omitted from policy generation. Assess it separately before changing it. AWS: Last accessed information and AWS: Policy generation- Other policy controls: IAM identity last-accessed reports do not include access paths represented by resource-based policies, ACLs, Organizations service control policies (SCPs), permissions boundaries, or session policies. Consider the full effective-permissions context when deciding what access the function has. AWS: IAM last accessed information
- Service support and history: Action-level evidence is not available for every service or action, and tracking history varies by service. Missing evidence is not proof of non-use.
- Analysis coverage and cost: Unused-access findings exclude service-linked roles. AWS charges for unused-access analysis based on IAM roles and users analyzed per analyzer per month; check current AWS pricing for your account before enabling it. AWS: Access Analyzer
- Replacement-policy recommendations: AWS may recommend replacement policies for some unused-permission findings, but recommendation support excludes cases including IAM Identity Center roles, IAM users in groups, and existing policies containing
NotAction. AWS: Findings
Reduce permissions cautiously
- List the candidate permissions from the unused-access findings and last-accessed reports.
- Compare them with the function’s expected behavior and workload schedule. Make sure the observation window includes relevant infrequent or scheduled execution paths.
- Use CloudTrail to inspect relevant calls and whether they succeeded or were denied. Investigate evidence gaps such as data-plane activity and
iam:PassRoleseparately. - Make a reviewed, limited policy change rather than replacing the role policy wholesale with an automatically generated template.
- Observe the function after the change and check for failures in its actual workload. This operational check is essential because the AWS reports alone cannot establish that every possible execution path has been covered.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
