Automatically Reducing Privilege for Access Control Policies
summary
Tool named IAM-PolicyRefiner synthesizes tighter AWS IAM policies from three months of real access logs, removing on average 77% of allowed actions and 88% of resource patterns while preserving observed requests. It models element patterns as predicates in a lattice with associative join operators (supports wildcards, numeric, regex, IP masks), guarantees soundness and computes the least-permissive refinements that satisfy readability soundness tightness, parallelizes to cut runtime from ~75s to ~5s.
AI-written summary · about
chapters (6)
- 0:00IM policy refinement for AWS
- 2:09Refinement properties and goals
- 7:43Refining predicates with lattice
- 12:40IM refiner on AWS data
- 15:30Conclusion and future
- 16:13Q&A
related talks
41mRefine unused access confidently with IAM Access Analyzer
19mMove toward least privilege with IAM Access Analyzer
25mIdentifying and Reducing Permission Explosion in AWS: A Graph-Based and Analytical Approach
29mAiIAM: Transforming the Democratized AWS IAM...
37mLocking Down the Security of IAM
52mIAM policy power hour
34mScaling access with AWS IAM Identity Center, feat.
59mProvably secure authorization