access-analyzer: `configuration` is always null. Cannot get the "tracking period"

[OhadR]

Describe the bug

i have "unused access-analyzer" and using the SDK i want to get its tracking period. from the docs, i understood that i should get the "configuration" o bject, and then dig in the unused-configurations, and then get the tracking period. but from some reason, the analyzer.configuration() returns null.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

i would like to get the configuration object, as mentioned in the docs. and then get the tracking period.

Current Behavior

i get null.

Reproduction Steps

        List<AnalyzerSummary> analyzers = listAnalyzers();
        for(AnalyzerSummary analyzer : analyzers) {
            log.info("analyzer name= {} arn= {}", analyzer.name(), analyzer.arn());
            AnalyzerConfiguration configuration = analyzer.configuration();
            log.info("configuration: " + configuration);

...

Possible Solution

No response

Additional Information/Context

No response

AWS Java SDK version used

2.33.X (and also tried other versions)

JDK version used

"21.0.6" 2025-01-21 LTS

Operating System and version

MAC

[debora-ito]

Hi @OhadR

Can you generate the verbose wirelogs (instructions here) of the API call? Was configuration sent in the response?
The wirelogs will help identify if this is a SDK issue unmarshalling the response, or if the configuration field is not being sent in the service response originally.

If you share the wirelogs here, please redact any sensitive data (like access keys).

[OhadR]

Thanks @debora-ito for the reply!

here is my logs, i hope this is what you meant. If not - please let me know what is missing...

2025-09-08 21:33:20.130 [DEBUG] [main] AccessAnalyzerService : Successfully created accessAnalyzerClient for account/region `us-west-2` using assumeRole()

2025-09-08 21:33:20.993 [DEBUG] [main] request : Sending Request: DefaultSdkHttpFullRequest(httpMethod=GET, protocol=https, host=access-analyzer.us-west-2.amazonaws.com, encodedPath=/analyzer, headers=[amz-sdk-invocation-id, User-Agent], queryParameters=[])
2025-09-08 21:33:20.994 [DEBUG] [main] wire : http-outgoing-15 >> "GET /analyzer HTTP/1.1[\r][\n]"
2025-09-08 21:33:20.994 [DEBUG] [main] wire : http-outgoing-15 >> "Host: access-analyzer.us-west-2.amazonaws.com[\r][\n]"
2025-09-08 21:33:20.994 [DEBUG] [main] wire : http-outgoing-15 >> "amz-sdk-invocation-id: 59d541aa-1de4-6328-f601-6da26704b30e[\r][\n]"
2025-09-08 21:33:20.994 [DEBUG] [main] wire : http-outgoing-15 >> "amz-sdk-request: attempt=1; max=4[\r][\n]"
2025-09-08 21:33:20.994 [DEBUG] [main] wire : http-outgoing-15 >> "Authorization: ***********"
2025-09-08 21:33:20.994 [DEBUG] [main] wire : http-outgoing-15 >> "User-Agent: aws-sdk-java/2.33.0 md/io#sync md/http#Apache ua/2.1 api/AccessAnalyzer#2.33.x os/Mac_OS_X#15.6 lang/java#21.0.6 md/Java_HotSpot_TM__64-Bit_Server_VM#21.0.6+8-LTS-188 md/vendor#Oracle_Corporation md/en_IL cfg/auth-source#stat m/D[\r][\n]"
2025-09-08 21:33:20.995 [DEBUG] [main] wire : http-outgoing-15 >> "x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855[\r][\n]"
2025-09-08 21:33:20.995 [DEBUG] [main] wire : http-outgoing-15 >> "X-Amz-Date: 20250908T183320Z[\r][\n]"
2025-09-08 21:33:20.995 [DEBUG] [main] wire : http-outgoing-15 >> "X-Amz-Security-Token: *******"
2025-09-08 21:33:20.996 [DEBUG] [main] wire : http-outgoing-15 >> "Connection: Keep-Alive[\r][\n]"
2025-09-08 21:33:20.996 [DEBUG] [main] wire : http-outgoing-15 >> "[\r][\n]"
2025-09-08 21:33:21.268 [DEBUG] [main] wire : http-outgoing-15 << "HTTP/1.1 200 OK[\r][\n]"
2025-09-08 21:33:21.269 [DEBUG] [main] wire : http-outgoing-15 << "Date: Mon, 08 Sep 2025 18:33:21 GMT[\r][\n]"
2025-09-08 21:33:21.269 [DEBUG] [main] wire : http-outgoing-15 << "Content-Type: application/json[\r][\n]"
2025-09-08 21:33:21.269 [DEBUG] [main] wire : http-outgoing-15 << "Content-Length: 730[\r][\n]"
2025-09-08 21:33:21.270 [DEBUG] [main] wire : http-outgoing-15 << "Connection: keep-alive[\r][\n]"
2025-09-08 21:33:21.270 [DEBUG] [main] wire : http-outgoing-15 << "x-amzn-RequestId: fcca9381-3a18-4397-9177-2f70631a8c4f[\r][\n]"
2025-09-08 21:33:21.270 [DEBUG] [main] wire : http-outgoing-15 << "x-amz-apigw-id: QmIpvEArPHcEdEg=[\r][\n]"
2025-09-08 21:33:21.271 [DEBUG] [main] wire : http-outgoing-15 << "X-Amzn-Trace-Id: Root=1-68bf2171-59bb5f0d1f90ddb6055c0f11[\r][\n]"
2025-09-08 21:33:21.271 [DEBUG] [main] wire : http-outgoing-15 << "[\r][\n]"
2025-09-08 21:33:21.271 [DEBUG] [main] wire : http-outgoing-15 << "{[\n]"
2025-09-08 21:33:21.275 [DEBUG] [main] wire : http-outgoing-15 << "  "analyzers" : [ {[\n]"
2025-09-08 21:33:21.276 [DEBUG] [main] wire : http-outgoing-15 << "    "arn" : "arn:aws:access-analyzer:us-west-2:565xxxxxxxxxx:analyzer/UnusedAccess-ConsoleAnalyzer-80days",[\n]"
2025-09-08 21:33:21.279 [DEBUG] [main] wire : http-outgoing-15 << "    "name" : "UnusedAccess-ConsoleAnalyzer-80days",[\n]"
2025-09-08 21:33:21.281 [DEBUG] [main] wire : http-outgoing-15 << "    "type" : "ACCOUNT_UNUSED_ACCESS",[\n]"
2025-09-08 21:33:21.281 [DEBUG] [main] wire : http-outgoing-15 << "    "createdAt" : "2025-09-08T18:32:44Z",[\n]"
2025-09-08 21:33:21.281 [DEBUG] [main] wire : http-outgoing-15 << "    "tags" : { },[\n]"
2025-09-08 21:33:21.284 [DEBUG] [main] wire : http-outgoing-15 << "    "status" : "ACTIVE"[\n]"
2025-09-08 21:33:21.284 [DEBUG] [main] wire : http-outgoing-15 << "  }, {[\n]"
2025-09-08 21:33:21.284 [DEBUG] [main] wire : http-outgoing-15 << "    "arn" : "arn:aws:access-analyzer:us-west-2:565xxxxxxxxxx:analyzer/ExternalIAMAccessAnalyzer",[\n]"
2025-09-08 21:33:21.284 [DEBUG] [main] wire : http-outgoing-15 << "    "name" : "ExternalIAMAccessAnalyzer",[\n]"
2025-09-08 21:33:21.285 [DEBUG] [main] wire : http-outgoing-15 << "    "type" : "ACCOUNT",[\n]"
2025-09-08 21:33:21.285 [DEBUG] [main] wire : http-outgoing-15 << "    "createdAt" : "2025-03-03T23:48:44Z",[\n]"
2025-09-08 21:33:21.285 [DEBUG] [main] wire : http-outgoing-15 << "    "tags" : { },[\n]"
2025-09-08 21:33:21.285 [DEBUG] [main] wire : http-outgoing-15 << "    "lastResourceAnalyzed" : "arn:aws:iam::565xxxxxxxxxx:role/CortexPlatformScannerRole-m-o-999xxxxxxxxxx",[\n]"
2025-09-08 21:33:21.285 [DEBUG] [main] wire : http-outgoing-15 << "    "lastResourceAnalyzedAt" : "2025-09-08T08:27:54.098Z",[\n]"
2025-09-08 21:33:21.285 [DEBUG] [main] wire : http-outgoing-15 << "    "status" : "ACTIVE"[\n]"
2025-09-08 21:33:21.285 [DEBUG] [main] wire : http-outgoing-15 << "  } ][\n]"
2025-09-08 21:33:21.285 [DEBUG] [main] wire : http-outgoing-15 << "}"
2025-09-08 21:33:21.286 [DEBUG] [main] request : Received successful response: 200, Request ID: fcca9381-3a18-4397-9177-2f70631a8c4f, Extended Request ID: not available
2025-09-08 21:33:21.290 [INFO ] [main] AccessAnalyzerService : analyzer name= UnusedAccess-ConsoleAnalyzer-80days arn= arn:aws:access-analyzer:us-west-2:565xxxxxxxxxx:analyzer/UnusedAccess-ConsoleAnalyzer-80days
2025-09-08 21:33:21.290 [INFO ] [main] AccessAnalyzerService : configuration: null

i guess the configuration is not sent in the response... so this is not SDK issue; if I am correct - where should i place this ticket?
thanks!

[debora-ito]

I can reach out to the Access Analyzer service team internally on your behalf. If you have access to a AWS Support plan you can also open a case to them directly.

I have one question though: you mentioned you're looking for the "tracking period" that would be present under the configuration field, but looking at the AnalyzerSummary API reference I couldn't find a tracking period in the AnalyzerConfiguration object. Can you clarify what "tracking period" you're looking for exactly? Can you link the documentation?

[OhadR]

Hi,

According to the docs, the /analyzer call retutns "AnalyzerSummary", that contains "configuration" object (AnalyzerConfiguration) that contains internalAccess OR unusedAccess.
the UnusedAccessConfiguration has unusedAccessAge:

The specified access age in days for which to generate findings for unused access. For example, if you specify 90 days, the analyzer will generate findings for IAM entities within the accounts of the selected organization for any access that hasn't been used in 90 or more days since the analyzer's last scan. You can choose a value between 1 and 365 days.

and this is exactly what i need. But from some reason, the "AnalyzerConfiguration" is always null.

So you open a case/ticket to the Access Analyzer team?

Thanks!