Cloud, Kubernetes and Infrastructure Security
Cloud IAM and Privilege Analysis
We determine what each identity in your cloud accounts can actually access. We show the role chains leading to administrator rights and the smallest change that breaks each one.
What it is
In the cloud, identities, not network boundaries, define access. An identity's real privilege does not appear in any single policy. It results from the combination of role assumption, resource policies, and cross-account trust. The analysis models this as a graph and maps the paths to sensitive resources.
Scope
- All policies attached to users, groups, roles, and service accounts
- Role assumption and impersonation relationships
- Resource-based policies and cross-account trust relationships
- Known permission combinations that enable privilege escalation
- Unused permissions and access keys not rotated for a long time
The need
When organizations need it
- When the number of accounts and subscriptions increases and no one has a central view of who can access what.
- When broad permissions granted for speed are not revoked after a project ends.
- When you are a regulated financial institution using cloud services. Regulators expect you to retain control over data access, even in outsourced systems.
Method
How we work
-
Data collection
With read-only access, we export all identity, role, and policy definitions.
-
Privilege graph
We combine identities, roles, and resources in a single graph and calculate each identity's effective privilege.
-
Path analysis
We map the paths to critical resources and administrator roles. With your approval, we test the critical ones in a controlled environment.
-
Smallest change
We recommend the smallest permission change that blocks each path. The change is selected based on actual usage shown in the logs.
Outcome
What you have at the end
You receive a privilege map showing how each identity reaches each critical resource. The smallest permission change to block each path is listed in priority order.
Frequently asked questions
Will removing excessive permissions break our applications?
Recommendations are based on actual usage from logs. Unused permissions are removed first. Critical changes are tested in a test environment first.
Does this analysis replace a cloud penetration test?
The analysis maps all possible paths. A penetration test checks if selected paths can actually be exploited. The two complement each other.
Cloud, Kubernetes and Infrastructure Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting