AWS IAM Access Analyzer

Connect

Activate your license key and start the emulator with the Vera launcher, as in Activate Pro, then run this in a terminal of its own, from an empty scratch directory. It gives the official AWS CLI dummy credentials and a config file of its own, so no AWS account is needed and your own AWS profile isn't touched.

export VERA_ENDPOINT="http://localhost:5003"
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_REGION=us-east-1 AWS_DEFAULT_REGION=us-east-1
export AWS_SHARED_CREDENTIALS_FILE=/dev/null
export AWS_EC2_METADATA_DISABLED=true
export AWS_PAGER="" AWS_CLI_AUTO_PROMPT=off
unset AWS_PROFILE AWS_DEFAULT_PROFILE
unset AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
unset AWS_WEB_IDENTITY_TOKEN_FILE AWS_ROLE_ARN AWS_ROLE_SESSION_NAME
unset AWS_CONTAINER_CREDENTIALS_FULL_URI
unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
cat > vera-aws-config <<'EOF'
[default]
region = us-east-1
output = json
cli_binary_format = base64
s3 =
    addressing_style = path
EOF
export AWS_CONFIG_FILE="$PWD/vera-aws-config"

When you've finished every example in this terminal, close it and delete vera-aws-config, not before.

The emulator serves IAM Access Analyzer’s 2019-11-01 API over the REST JSON protocol, through the AWS CLI’s accessanalyzer commands. Analyzer ARNs name the account configured on your Vera instance, such as arn:aws:access-analyzer:us-east-1:123456789012:analyzer/docs-example-analyzer.

Example

Create an account analyzer and read it back:

ANALYZER_ARN=$(aws --endpoint-url "$VERA_ENDPOINT" accessanalyzer create-analyzer \
  --analyzer-name docs-example-analyzer --type ACCOUNT --tags '{"purpose":"documentation"}' \
  --query arn --output text)
aws --endpoint-url "$VERA_ENDPOINT" accessanalyzer get-analyzer --analyzer-name docs-example-analyzer

The analyzer is active at once. The output includes these fields, and createdAt differs on every run:

Output (selected fields)

{
    "analyzer": {
        "arn": "arn:aws:access-analyzer:us-east-1:123456789012:analyzer/docs-example-analyzer",
        "name": "docs-example-analyzer",
        "type": "ACCOUNT",
        "createdAt": "2026-11-03T18:09:54+00:00",
        "tags": {
            "purpose": "documentation"
        },
        "status": "ACTIVE"
    }
}

List its findings, and validate an identity policy that allows reading objects from one bucket. The bucket ARN is only text in the policy, so no bucket has to exist.

aws --endpoint-url "$VERA_ENDPOINT" accessanalyzer list-findings --analyzer-arn "$ANALYZER_ARN"
aws --endpoint-url "$VERA_ENDPOINT" accessanalyzer validate-policy --policy-type IDENTITY_POLICY \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::docs-example-bucket/*"}]}'

Both return an empty list, {"findings":[]}. An empty list from the emulator doesn’t mean the policy is safe: see Limitations.

To clean up, delete the analyzer. The command prints nothing.

aws --endpoint-url "$VERA_ENDPOINT" accessanalyzer delete-analyzer --analyzer-name docs-example-analyzer

Supported features

• Account analyzers, created with tags, read and deleted.
• Findings: ListFindings answers for an analyzer. A new one’s list is empty.
• Policy validation: ValidatePolicy returned no findings for the scoped policy above. For a second policy, with "Resource": "*", it returned one SECURITY_WARNING, with issueCode: WILDCARD_RESOURCE and findingDetails: "Allow statement at index 0 grants access to all resources."
• Policy generation, synthetic: a job started with StartPolicyGeneration for a local IAM role that doesn’t exist completed as SUCCEEDED, and GetGeneratedPolicy returned a template allowing s3:GetObject on *, with isComplete: true. No access history was needed.
• Also served, not yet tested: archive rules, access previews, updating findings and their recommendations, custom policy checks such as CheckNoNewAccess and CheckNoPublicAccess, resource scans, service-linked analyzers and tags.

Limitations

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

• Validation isn’t AWS’s analysis. It follows the emulator’s own rules. Two policies were checked, a scoped one and a wildcard one, which doesn’t establish that results match AWS’s. No findings isn’t a clean bill of health.
• Generated policies are synthetic. A generation job completes without any access history, even for a role that doesn’t exist, and returns a template. Earlier source inspection, on 3 November 2026, found that it doesn’t derive permissions from CloudTrail activity.
• Analysis wasn’t tested. Scans of accounts and resources, organization analysis, archive rules, access previews, recommendations and custom policy checks weren’t verified, so don’t expect findings about real access to your resources.

API coverage

Every operation in AWS's published 2019-11-01 API (SDK model, botocore 1.43.105), and whether the emulator implements it. Availability combines the earlier implementation inventory with the dated observations below; checking a page's example does not verify every operation. Each note names its evidence first; an observation given without a build or date comes from earlier testing, on 3 November 2026. What the statuses mean

Operation	Status	Notes
ApplyArchiveRule	Implemented
CancelPolicyGeneration	Implemented
CheckAccessNotGranted	Implemented
CheckNoNewAccess	Implemented
CheckNoPublicAccess	Implemented
CreateAccessPreview	Implemented
CreateAnalyzer	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — created an ACCOUNT analyzer with tags.
CreateArchiveRule	Implemented
CreateServiceLinkedAnalyzer	Implemented
DeleteAnalyzer	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — deleted the analyzer, with no response body.
DeleteArchiveRule	Implemented
DeleteServiceLinkedAnalyzer	Implemented
GenerateFindingRecommendation	Implemented
GetAccessPreview	Implemented
GetAnalyzedResource	Implemented
GetAnalyzer	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — returned the analyzer's name, type: ACCOUNT, status: ACTIVE, its tags and a generated createdAt.
GetArchiveRule	Implemented
GetFinding	Implemented
GetFindingRecommendation	Implemented
GetFindingV2	Implemented
GetFindingsStatistics	Implemented
GetGeneratedPolicy	Known difference	Local observation: Vera 1.2.0 preview, 5 November 2026 — for that job, returned a template allowing s3:GetObject on *, with isComplete: true. Source inspection: 3 November 2026 — Builds policy output from a fixed S3 template, with limited changes for the request flags, rather than deriving permissions from observed access history.
ListAccessPreviewFindings	Implemented
ListAccessPreviews	Implemented
ListAnalyzedResources	Implemented
ListAnalyzers	Implemented
ListArchiveRules	Implemented
ListFindings	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — returned an empty findings list for a new account analyzer.
ListFindingsV2	Implemented
ListPolicyGenerations	Implemented
ListTagsForResource	Implemented
StartPolicyGeneration	Known difference	Local observation: Vera 1.2.0 preview, 5 November 2026 — a job for a local IAM role that doesn't exist completed as SUCCEEDED, with no access history. Source inspection: 3 November 2026 — Immediately creates a SUCCEEDED job record; this path does not analyze CloudTrail activity to derive a policy.
StartResourceScan	Implemented
TagResource	Implemented
UntagResource	Implemented
UpdateAnalyzer	Implemented
UpdateArchiveRule	Implemented
UpdateFindings	Implemented
ValidatePolicy	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — returned no findings for an identity policy allowing s3:GetObject on one bucket's objects, and one SECURITY_WARNING with issueCode: WILDCARD_RESOURCE for a second policy, with Resource: *. Two policies don't establish parity with AWS's analysis.