Using AWS SCPs to achieve least privilege while supporting devs
summary
Analysis of multi-account AWS estates finds almost half of identities hold a sensitive permission but only 8% use them in 90 days, and 61% of identities are long-unused; a 30–50 account shop shows ~35,000 identities with ~26,000 unused. The approach builds a map of about 1000 permissions to deny centrally via SCPs, apply targeted exemptions for the ~7% that need them, and surface denials into ChatOps so teams can restore access in 10–20 seconds. It relies on deny wins and SCP compression to scale.
AI-written summary · about
chapters (14)
- 0:00Challenges of IAM management
- 0:41Identity sprawl and risk
- 4:21The scale of unused access
- 4:45Using SCPs for central control
- 6:16Four keys to SCP management
- 7:52Automation and exceptions
- 9:48Q&A on SCP scaling
- 13:19Product demo overview
- 13:33Finding sensitive permissions
- 13:45Applying protection modes
- 14:28Setting up account exemptions
- 14:43Handling user denial errors
- 15:05Real-time incident response
- 15:18Self-approval for access
related talks
25mIdentifying and Reducing Permission Explosion in AWS: A Graph-Based and Analytical Approach
38mChanging Perspectives: A Deep Dive into the Security Posture of 600+ Real-World AWS Environments
12mIdentity and permissions concerns to watch out for
58mCreate enterprise-wide preventive guardrails
44mAchieve your identity, security, and compliance goals on
34mScaling access with AWS IAM Identity Center, feat.
55mBalance least privilege & agile development
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!