中文
devexamples
← Workflows

阅读中文版本

Cloud IAM Policy Review Workflow

List principals and their policies, find wildcard and unused permissions, right-size to least privilege, and keep an owner for every access grant.

advanced~150 minsecurityiamcloud

Objective

Reduce cloud attack surface by reviewing IAM policies for over-permission and unused grants.

Environment

  • Cloud access analyzer or logs
  • An inventory of principals and owners

Steps

1. Enumerate principals, roles, and attached policies

Enumerate principals, roles, and attached policies.

Expected state: The access surface is fully listed.

2. Flag wildcard actions, resources, and unused

Flag wildcard actions, resources, and unused permissions.

Expected state: Over-permission is identified.

3. Right-size policies from observed usage

Right-size policies from observed usage with a safe margin.

Expected state: Permissions match real need.

4. Assign an owner to every role

Assign an owner to every role and require review on change.

Expected state: Access is accountable.

Decision points

Revoke unused permissions immediately?

  • After two usage cycles
  • Immediately

Two full usage cycles (for example two months) avoids breaking quarterly jobs; then revoke.

Break-glass role allowed?

  • Yes, monitored
  • No

Allow a monitored break-glass role with alerts; eliminating it pushes people to worse workarounds.

Expected outcome

IAM policies with wildcards and unused permissions reduced, usage-based right-sizing, and an owner recorded for each grant.

Verification

Confirm that no production role retains wildcard admin without justification and that unused-permission findings dropped after right-sizing.

Cleanup

Record before and after findings and add a recurring review cadence.

Overview

Reduce cloud attack surface by reviewing IAM policies for over-permission and unused grants. Confirm that no production role retains wildcard admin without justification and that unused-permission findings dropped after right-sizing.

Steps

  1. Enumerate principals, roles, and attached policies. Expected state: The access surface is fully listed.
  2. Flag wildcard actions, resources, and unused permissions. Expected state: Over-permission is identified.
  3. Right-size policies from observed usage with a safe margin. Expected state: Permissions match real need.
  4. Assign an owner to every role and require review on change. Expected state: Access is accountable.
aws iam generate-service-last-accessed-details --arn arn:aws:iam::123456789012:role/app
aWS iam get-service-last-accessed-details --job-id $JOB | jq '.ServicesLastAccessed[] | select(.TotalAuthenticatedEntities==0)'

Verification

  • IAM policies with wildcards and unused permissions reduced, usage-based right-sizing, and an owner recorded for each grant.

Decision points

  • Revoke unused permissions immediately? Options: After two usage cycles; Immediately. Recommended: Two full usage cycles (for example two months) avoids breaking quarterly jobs; then revoke.
  • Break-glass role allowed? Options: Yes, monitored; No. Recommended: Allow a monitored break-glass role with alerts; eliminating it pushes people to worse workarounds.