Linking AWS IAM Access Analyzer as a source

Beta release

This source is currently in beta. It works end to end, but you may still hit rough edges. Let us know if you do.

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

Learn more

The AWS IAM Access Analyzer connector syncs access analyzers, findings, archive rules, analyzed resources, finding details, and remediation recommendations into the PostHog data warehouse, so you can analyze security findings alongside your product data.

Prerequisites

Credentials that can read the data you want to sync. PostHog only reads data, so read access is enough.

Adding a data source

In PostHog, go to the Sources tab of the data pipeline section.
Click + New source and click Link next to this source.
Enter your credentials (see Configuration below) and click Next.
Select the tables you want to sync, choose a sync method and frequency, then click Import.

Once the syncs are complete, you can start querying this data in PostHog.

Sync your access analyzers, security findings, and remediation recommendations from one AWS region.

Create an IAM user or role with the following permissions, then paste its access key ID and secret access key. Add a session token too if you are using temporary credentials.

access-analyzer:ListAnalyzers
access-analyzer:ListFindings
access-analyzer:ListArchiveRules
access-analyzer:ListAnalyzedResources
access-analyzer:GetFinding
access-analyzer:GetFindingRecommendation

You'll be asked for:

AWS access key ID - for example AKIA....
AWS secret access key
AWS session token (optional) - only needed for temporary credentials. Temporary credentials expire, so update them before later syncs.
AWS region (optional) - the region where your analyzers are configured. Defaults to us-east-1.

Sync modes

Each table can be synced in one of several modes, depending on what the source supports:

Webhook (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
Incremental – only new or updated rows are synced on each run, using a cursor field (such as an updated_at timestamp). Cheaper than a full refresh, but deletes aren't captured.
Append only – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
Full refresh – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.

See sync methods for a full explanation of how each mode works and how to choose between them.

All AWS IAM Access Analyzer tables are full refresh. Each sync replaces the contents of the table. The API does not support a date-range filter for findings.

Configuration

Option	Description
`AWS access key ID` Type: text Required: True
`AWS secret access key` Type: password Required: True
`AWS session token` Type: password Required: False
`AWS region` Type: text Required: False	Leave this blank to use us-east-1.

Supported tables

Table	Description	Sync method	Incremental field	Primary key
`analyzers`	Access analyzers in the configured AWS region.	Full refresh	—	—
`findings`	External, internal, and unused access findings from each analyzer.	Full refresh	—	—
`archive_rules`	Rules that automatically archive findings for each analyzer.	Full refresh	—	—
`analyzed_resources`	Resources that each external access analyzer analyzed, with or without findings.	Full refresh	—	—
`finding_details`	Full findings with the principals, actions, and unused permissions behind each finding.	Full refresh	—	—
`finding_recommendations`	Remediation steps for unused permission findings that already have a generated recommendation.	Full refresh	—	—

Analyzer type filtering

Some tables only work with specific analyzer types:

analyzed_resources - Only syncs from external access analyzers (ACCOUNT or ORGANIZATION type). Unused access and internal access analyzers do not support resource enumeration.
finding_recommendations - Only syncs from unused access analyzers (ACCOUNT_UNUSED_ACCESS or ORGANIZATION_UNUSED_ACCESS type) and only for UnusedPermission findings that already have a generated recommendation.

Note: The sync only reads existing recommendations. It never generates new ones because data warehouse syncs are read-only. If a finding doesn't have a recommendation yet, generate one in the AWS console first.

Troubleshooting

If the connection fails with an authorization error, the AWS access key ID may be wrong, expired, or revoked. Create a new one, then reconnect the source.
If a table syncs no rows, the credential may not have access to that data. Check its permissions, then reconnect the source.
If analyzed_resources returns no data, check that you have at least one external access analyzer (not an unused access analyzer).
If finding_recommendations returns no data, check that you have unused access analyzers and that recommendations have been generated in AWS.

If your sync is failing or data looks wrong, see the Data warehouse troubleshooting guide. If that doesn't help, contact support – we're happy to help.