docs: def access(config, region, accounts=()):
      """Check iam permissions for log export access in each account"""
      config = validate.callback(config)
      accounts_report = []
  
      def check_access(account):
          accounts_report.append(account)
          session = get_session(account['role'], region)
          identity = session.client('sts').get_caller_identity()
          account['account_id'] = identity['Account']
          account.pop('groups')
          account.pop('role')
          client = session.client('iam')
          policy_arn = identity['Arn']
          if policy_arn.count('/') > 1:
              policy_arn = policy_arn.rsplit('/', 1)[0]
          if ':sts:' in policy_arn:
              policy_arn = policy_arn.replace(':sts', ':iam')
          if ':assumed-role' in policy_arn:
              policy_arn = policy_arn.replace(':assumed-role', ':role')
          evaluation = client.simulate_principal_policy(
              PolicySourceArn=policy_arn,
              ActionNames=['logs:CreateExportTask'])['EvaluationResults']
          account['access'] = evaluation[0]['EvalDecision']
  
      with ThreadPoolExecutor(max_workers=16) as w:
          futures = {}
          for account in config.get('accounts', ()):
              if accounts and account['name'] not in accounts:
                  continue
              futures[w.submit(check_access, account)] = None
          for f in as_completed(futures):
              pass
      accounts_report.sort(key=operator.itemgetter('access'), reverse=True)
      print(tabulate(accounts_report, headers='keys'))