Help Center/ Identity and Access Management_Identity and Access Management (New Edition)/ API Reference/ API/ Access Analyzer/ Analyzers/ Creating an Analyzer
Updated on 2026-07-22 GMT+08:00
View PDF
Share

Creating an Analyzer

Function

This API is used to create an analyzer for your account or organization.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action

Access Level

Resource Type (*: required)

Condition Key

Alias

Dependencies

AccessAnalyzer:analyzer:create

Write

analyzer *

-

-

iam:agencies:createServiceLinkedAgencyV5

-

  • g:RequestTag/<tag-key>

  • g:TagKeys

URI

POST /v5/analyzers

Request Parameters

Table 1 Request body parameters

Parameter

Mandatory

Type

Description

configuration

No

AnalyzerConfiguration object

Definition:

Configuration items of the analyzer.

Constraints:

N/A

Range:

N/A

Default Value:

N/A

name

Yes

String

Definition:

Analyzer name.

Constraints:

Must start with a letter.

Range:

1 to 255 characters. Only letters, digits, underscores (_), hyphens (-), and periods (.) are allowed.

Default Value:

N/A

tags

No

Array of Tag objects

Definition:

List of custom tags.

Constraints:

N/A

Range:

Array length: 1 to 20.

Default Value:

N/A

type

Yes

String

Definition:

Analyzer type.

Constraints:

N/A

Range:

  • account: account-level external access analyzer

  • organization: organization-level external access analyzer

  • account_unused_access: account-level unused access analyzer

  • organization_unused_access: organization-level unused access analyzer

  • account_privilege_escalation: account-level privilege escalation access analyzer

  • account_iam_best_practice: account-level IAM best practice analyzer

Default Value:

N/A
Table 2 AnalyzerConfiguration

Parameter

Mandatory

Type

Description

unused_access

No

unused_access object

Definition:

Configuration items of unused access analyzers.

Constraints:

N/A

Range:

N/A

Default Value:

N/A
Table 3 unused_access

Parameter

Mandatory

Type

Description

unused_access_age

Yes

Integer

Definition:

Preset number of days for generating findings.

Constraints:

N/A

Range:

The value ranges from 1 to 180.

Default Value:

90.

unused_analysis_rule

No

UnusedAnalysisRule object

Definition:

Unused analysis rule.

Constraints:

N/A

Range:

N/A

Default Value:

N/A
Table 4 UnusedAnalysisRule

Parameter

Mandatory

Type

Description

exclusions

No

Array of UnusedAnalysisRuleCriteria objects

Definition:

Exclusion rule.

Constraints:

N/A

Range:

N/A

Default Value:

N/A
Table 5 UnusedAnalysisRuleCriteria

Parameter

Mandatory

Type

Description

account_ids

No

Array of strings

Definition:

List of organization account IDs. This parameter is optional when you create an unused access analyzer at the organization level. The specified accounts will not generate analysis findings.

To view the list of your organization account IDs on the Huawei Cloud console, perform the following steps:

  1. Log in to the Huawei Cloud console.

  2. Open the service list in the upper left corner of the page and choose Organizations.

  3. Click account management on the left to view the account ID list of the organization.

Constraints:

N/A

Range:

The array length ranges from 1 to 2,000. The array elements contain 1 to 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.

Default Value:

N/A

resource_tags

No

Array of Tag objects

Definition:

List of resource tags.

Constraints:

N/A

Range:

Array length: 1 to 20.

Default Value:

N/A
Table 6 Tag

Parameter

Mandatory

Type

Description

key

Yes

String

Definition:

Tag key.

Constraints:

Cannot start with sys and cannot start or end with a space.

Range:

1 to 128 characters. The value can contain Unicode letters, digits, spaces, and the following special characters: _.:=+-@.

Default Value:

N/A

value

Yes

String

Definition:

String value associated with the tag key.

Constraints:

N/A

Range:

0 to 255 characters. The value can contain Unicode letters, digits, spaces, and the following special characters: _.:/=+-@.

Default Value:

N/A

Response Parameters

Status code: 201

Table 7 Response body parameters

Parameter

Type

Description

id

String

Definition:

Unique identifier of an analyzer.

Range:

1 to 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.

urn

String

Definition:

Unique resource identifier of an analyzer.

Range:

The value can contain up to 1,500 characters.

Example Requests

Creating an analyzer for your account or organization

POST https://{hostname}/v5/analyzers

{
  "name" : "my-analyzer",
  "tags" : [ {
    "key" : "key-1",
    "value" : "value-1"
  } ],
  "type" : "account"
}

Example Responses

Status code: 201

Created

{
  "id" : "{analyzer_id}",
  "urn" : "AccessAnalyzer:{region_id}:{domain_id}:analyzer:{analyzer_id}"
}

Status Codes

Status Code

Description

201

Created

Error Codes

See Error Codes.

Parent topic: Analyzers