[Yandex Cloud documentation](../../index.md) > [Yandex Security Deck](../index.md) > [Concepts](index.md) > Access Analyzer

# Access Analyzer module

To ensure data and cloud infrastructure [security](../../security/standard/all.md), you need to regularly audit the access permissions of [users](../../overview/roles-and-resources.md#users) and [service accounts](../../iam/concepts/users/accounts.md#sa).

[Access Analyzer](https://center.yandex.cloud/security/access-analyzer/) is designed for analyzing access permissions of organization [subjects](../../iam/concepts/access-control/index.md#subject) for its resources, detecting unused and excessively granted privileges, and running diagnostics of access permissions to reduce information security risks.

## Recommendations {#recommendations}

{% note info %}

This feature, recommendations, is at the [Preview](../../overview/concepts/launch-stages.md) stage. To get access, contact [support](https://center.yandex.cloud/support) or your account manager.

{% endnote %}

Access Analyzer automatically analyzes roles assigned to users and groups for [folders](*folder_definition), [clouds](*cloud_definition), and [organizations](*organization_definition) and provides, in each individual case, specific _recommendations_ to improve security. The module does not provide recommendations regarding roles assigned to subjects for specific Yandex Cloud service resources, such as virtual machines, service accounts, managed database clusters, etc.

Analysis of roles starts when the Access Analyzer module is enabled in the [workspace](workspace.md) settings. After that, it runs regularly and automatically. The date and time of the last analysis are [displayed](../operations/access-analyzer/use-recommendations.md#view) on the page with a list of recommendations under the filter bar.

If the Access Analyzer module is disabled in the workspace settings, the recommendation feature is not available.

When running analysis or generating recommendations, Access Analyzer uses system logs of [Yandex Identity and Access Management](../../iam/index.md) authorizations over the last 90 days.

To view recommendations in the [Security Deck UI](https://center.yandex.cloud/security/access-analyzer/), users must have the `security-deck.viewer` [role](../security/index.md#security-deck-viewer) or higher for the [workspace](workspace.md).

Roles can be revoked or changed by users holding one of the following roles: `admin`, `resource-manager.admin`, `organization-manager.admin`, `resource-manager.clouds.owner`, and `organization-manager.organizations.owner`.

### Recommendation types {#recommendation-types}

Each recommendation suggest performing one of the following actions:

* [Replacing the current role](../operations/access-analyzer/use-recommendations.md#replace) with another, more [granular](*granular_definition) role or role group.

    Depending on your situation, the service may suggest one to five roles as a replacement. In this case, the total scope of permissions provided by the new roles is always less than that of the current role.
* [Revoking a role](../operations/access-analyzer/use-recommendations.md#revoke) from a subject.

    Revoking a role is recommended when permissions provided by the current role of the subject have not been used for authorizing operations in Yandex Cloud during the last 90 days.

If any recommendations do not suit you, you can [hide](../operations/access-analyzer/use-recommendations.md#manage-visibility) them.

For more information on working with recommendations, see [Working with recommendations in the Access Analyzer module](../operations/access-analyzer/use-recommendations.md).

{% note alert %}

Any recommendations regarding the revocation or modification of role compositions provided by the Access Analyzer module are general in nature and may ignore the specifics of your products and infrastructure.

Independently analyze any recommendations provided by the module. By accepting a recommendation, you assume the risk of potential consequences that may arise from implementing the proposed changes.

{% endnote %}

## Access diagnostics {#viewing-permissions}

{% note info %}

This Access Analyzer feature is at the [Preview](../../overview/concepts/launch-stages.md) stage.

{% endnote %}

The access diagnostics functionality allows you to view the access permissions assigned to an individual subject (user or service account):

* Directly
* Via a user group
* Via a system group
* Via a public group

For each access permission, the list indicates the name/ID and type of [resource](../../iam/concepts/access-control/resources-with-access-control.md) to which access was granted, the [role](../../iam/concepts/access-control/roles.md) assigned to the subject for that resource, and information about whether the role was assigned to the subject directly or was inherited from a group of which the subject is a member.

To check whether access to a particular resource was assigned to a subject directly or via a group, refer to the **Group** field of the table listing the subject’s access permissions. If the role was assigned directly, this field will be empty. In other cases, it will show the name of the group and its ID.

Access permissions are always assigned to groups directly, so for groups, the **Group** field of the table with aceess permissions is always empty.

You can filter the list of access permissions granted to a subject by:

* ID of the resource the access was granted to.
* ID of the granted role.
* Assignment method, `Directly appointed` or `Assigned via group`.

Only [organization members](../../organization/concepts/membership.md) with the `organization-manager.viewer` [role](../../organization/security/index.md#organization-manager-viewer) or higher for the organization can view access permissions in the [Security Deck interface](https://center.yandex.cloud/security/access-analyzer/). In this case you can use access diagnostics even if the Access Analyzer module is not enabled in the [workspace](workspace.md) settings.

The access diagnostics functionality allows you to [revoke](../operations/access-analyzer/analyze-permissions.md#revoke) excessive access permissions from individual subjects or groups and remove individual subjects from user groups.

To revoke access permissions, users must have one of these roles: `admin`, `resource-manager.admin`, `organization-manager.admin`, `resource-manager.clouds.owner`, `organization-manager.organizations.owner`, or the administrator role in the [service](../../overview/concepts/services.md) where they want to revoke the subject's access to a resource.

You can only remove a subject from a group created by an organization administrator. You cannot remove a subject from a system or public group.

#### Useful links {#see-also}

* [Working with recommendations in the Access Analyzer module](../operations/access-analyzer/use-recommendations.md)
* [Access diagnostics in Access Analyzer](../operations/access-analyzer/analyze-permissions.md)

[*folder_definition]: A folder is a logical space where you create and group your Yandex Cloud resources. Just like folders in your file system, Yandex Cloud folders make resource management simpler. For more information, see [Folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

[*cloud_definition]: A cloud is an isolated logical space where folders and other Yandex Cloud resources are created. You cannot move resources from one cloud to another. For more information, see [Cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud).

[*organization_definition]: An _organization_ is the highest resource in the Yandex Cloud resource model hierarchy that consolidates the resources of all other services. It is also used for user management as well as authentication and authorization management. For more information, see [Organization](../../organization/concepts/organization.md).

[*granular_definition]: In IT system access management, granularity refers to breaking down broad access permissions into distinct, narrow privileges based on the [principle of least privilege](../../iam/best-practices/using-iam-securely.md#restrict-access).