Resource state validation of access management policies

A method, comprising:

• monitoring, by an identity and access management system, for changes to one or more resources of a network-based service hosted by a provider network;
• based on the monitoring, detecting, by the identity access and management system, a first change at a first resource of the one or more resources;
• determining, by the identity and access management system, that an access management policy is affected by the detected first change, wherein the first resource is associated with an account of the provider network, wherein the access management policy describes one or more actions that are respectively allowed or denied by the provider network;
• and
• providing, via an interface of the identity and access management system, an indication that the access management policy is affected by the detected first change.

One or more non-transitory computer-readable storage media storing program instructions that, when executed on or across one or more computing devices, cause the one or more computing devices to implement:

• monitoring, by an identity and access management system, for changes to one or more resources of a network-based service hosted by a provider network;
• based on the monitoring, detecting, by the identity access and management system, a first change at a first resource of the one or more resources;
• determining, by the identity and access management system, that an access management policy is affected by the detected first change, wherein the first resource is associated with an account of the provider network, wherein the access management policy describes one or more actions that are respectively allowed or denied by the provider network;
• and
• providing, via an interface of the identity and access management system, an indication that the access management policy is affected by the detected first change.