Identifying and Reducing Permission Explosion in AWS: A Graph-Based and Analytical Approach
summary
Claims a 63% cut in AWS permissions by applying three concrete steps: revoke permissions not accessed in 90 days, drop permissions with a Permission Utilization Ratio under 10%, and split broad admin roles into focused subroles to cut permissions per user. Analysis runs on Python + Colab + SigmaJS + SQLite, computes a role-level Under-Utilization Ratio, and produces graphs. Operationalize with automated weekly policy generation that rebuilds and attaches least-used IAM policies.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:03Understanding permissions
- 4:01Causes of permission growth
- 6:31Measuring permissions
- 11:04Tooling and data schema
- 14:28Fixing permission explosion
- 18:04Managing role complexity
- 20:43Automation and conclusion
related talks
16mUsing AWS SCPs to achieve least privilege while supporting devs
19mAutomatically Reducing Privilege for Access Control Policies
41mRefine unused access confidently with IAM Access Analyzer
34mScaling access with AWS IAM Identity Center, feat.
28mYour journey to temporary credentials in the cloud
38mChanging Perspectives: A Deep Dive into the Security Posture of 600+ Real-World AWS Environments
19mSecuring your AWS environment with automated DSPM
12mIdentity and permissions concerns to watch out for