AWS IAM Access Analyzer pricing calculator
Internal Access, Unused Access & Policy Checks. Estimate your costs using AWS list prices.
Estimates from AWS list prices, not an AWS quote. Discounts, taxes and credit terms may affect your bill.
01 · How AWS IAM Access Analyzer pricing works
What you pay for
- External access analysis and policy validation/generation: no charge.
- Unused access analysis: $0.20 per IAM role or user analyzed per month.
- Internal access analysis: $9 per monitored resource per month.
- Custom policy checks: $0.002 per API call.
Common cost traps
- An organization-wide unused access analyzer bills every IAM role and user in every member account, including service-linked roles where counted.
- Internal access analysis at $9 per resource adds up quickly if you select many S3 buckets or tables.
- CI pipelines that run custom policy checks on every commit multiply API calls.
Ways to reduce cost
- Scope internal access analysis to your most sensitive resources.
- Delete stale roles and users before enabling unused access analysis.
- Run custom policy checks only on changed policies.
Free Tier & account eligibility
Free Tier depends on account age. Accounts created on or after 15 July 2025 get a $100 sign-up credit plus up to $100 more for completing onboarding activities; on the Free plan these last 6 months (or until used up), on the Paid plan unused Free Tier credits stay usable for 12 months from sign-up. Accounts created before 15 July 2025 keep the legacy Free Tier (12-month offers plus always-free offers). Always-free offers apply on both plans. External access findings, policy validation and policy generation are free on every plan. Paid analyzers have no free allowance; new-plan accounts can pay for them from Free Tier credits.
02 · AWS credits & runway
Do credits cover AWS IAM Access Analyzer?
Paid Access Analyzer analyzers (internal access, unused access) and custom policy check API calls are eligible usage and are offset by credits. General rules: credits only offset charges from the billing cycle in which they were applied onward (never past bills), they apply only to the services listed on the credit in Billing and Cost Management > Credits, they expire on the date shown there, and accounts on the AWS Free plan cannot receive Activate credits until they upgrade to the Paid plan.
Check my creditsExcluded charges & conditions
- Upfront payments for Savings Plans and Reserved Instances (All Upfront, and the upfront part of Partial Upfront). The recurring hourly fee of a No Upfront commitment is billed as normal usage and can be offset.
- AWS Marketplace charges (Activate credits make an exception for third-party foundation models used through Amazon Bedrock).
- AWS Enterprise Support, Enterprise On-Ramp, Unified Operations, resold support and partner-led support.
- Amazon Route 53 domain name registration and transfer fees.
- Taxes (sales, use, VAT and similar), AWS Professional Services, Training and Certification, Mechanical Turk, AWS Managed Services, and any use for cryptocurrency mining.
Illustrative credit runway
Single-service examples from the supplied data, not your calculator result. Months = credit amount ÷ monthly cost, before credit expiry. Credits can expire before these theoretical months are used; coverage and other AWS services can shorten runway.
| Usage profile | Monthly estimate | $10,000 | $25,000 | $100,000 |
|---|---|---|---|---|
| Small | $44.00 | 227.3 mo. | 568.2 mo. | 2,272.7 mo. |
| Medium | $620.00 | 16.1 mo. | 40.3 mo. | 161.3 mo. |
| Large | $7,100.00 | 1.4 mo. | 3.5 mo. | 14.1 mo. |
Small profile assumptions
Unused access analyzer on 200 IAM roles/users, 2,000 custom policy checks | Unused access (IAM roles/users): 200 resource-months x $0.2 = $40.00; Custom policy checks: 2,000 API calls x $0.002 = $4.00 | Total ~$44.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Medium profile assumptions
Unused access on 2,000 IAM principals, internal access on 20 critical resources, 20,000 policy checks | Unused access: 2,000 resource-months x $0.2 = $400.00; Internal access: 20 resource-months x $9 = $180.00; Custom policy checks: 20,000 API calls x $0.002 = $40.00 | Total ~$620.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Large profile assumptions
Unused access on 20,000 principals across an organization, internal access on 300 resources, 200,000 policy checks | Unused access: 20,000 resource-months x $0.2 = $4,000.00; Internal access: 300 resource-months x $9 = $2,700.00; Custom policy checks: 200,000 API calls x $0.002 = $400.00 | Total ~$7,100.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
04 · Questions
AWS IAM Access Analyzer pricing FAQ
Is IAM Access Analyzer free?
External access analysis and policy validation are free. Unused access ($0.20 per role or user per month), internal access ($9 per resource per month) and custom policy checks ($0.002 per call) are charged.
How is unused access billed?
Per IAM role and user analyzed per month, for each analyzer.
Do credits cover Access Analyzer?
Yes, paid analyzers are eligible usage.
How do I keep costs predictable?
Limit the number of analyzers, use exclusions for accounts you do not need, and select internal-access resources deliberately.
05 · Sources & estimate notes
Content pack dated 2026-10-19. Calculator rates remain their existing snapshots; this content update is not a price refresh.
Verification notes
- Runway prices come from the calculator repository snapshot rate card iam-access-analyzer (no AWS Price List mapping in the build). Confirm the main unit prices on https://aws.amazon.com/iam/access-analyzer/pricing/ before publishing.