Access Analyzer KMS

Access Analyzer KMS is a policy evaluation tool that lets security and cloud engineers validate whether a specified principal can perform a chosen KMS action on a given key by cross-checking IAM and KMS resource policies. It helps identify over-privilege and compliance gaps in multi-account environments.
Conceptually, it ingests policy documents, resource ARNs, and the action, then applies the standard policy evaluation logic to compute a yes/no outcome and a justification. The engine does not execute real API calls; it simulates permission checks in a deterministic manner.
Who benefits: developers integrating with cloud keys, security engineers auditing key access, and auditors verifying least-privilege controls. Unique value lies in combining policy parsing, cross-policy aggregation, and exportable results in both human-readable and machine-readable formats for automation.
Core features include input validation, policy normalization, denial-first evaluation, multi-policy reconciliation, and actionable outputs such as recommended mitigations and example denial paths.