HACKING PROJECT · cloud · Advanced
Least-Privilege IAM Auditing
Identify and remediate over-privileged cloud identities by measuring effective vs. used permissions and recommending least-privilege policies.
Cloud IAM sprawls into thousands of identities, roles, and policies where excessive, unused, and toxic permission combinations quietly accumulate, making over-privilege the single most exploited cloud weakness (privilege escalation, lateral movement, blast-radius amplification). Static policy review cannot reveal what access is actually used versus merely granted. Teams struggle to right-size permissions without breaking workloads.
**What you'll build**
Build an IAM auditing tool that inventories identities and policies across cloud accounts, analyzes effective permissions, correlates granted vs. actually-used access (via CloudTrail/Access Analyzer/Access Advisor), detects privilege-escalation paths and toxic combinations, and generates least-privilege policy recommendations. Model relationships as an identity/permission graph to surface escalation chains and cross-account trust risks, output prioritized findings, and produce right-sized policy diffs.
**Objective** — Identify and remediate over-privileged cloud identities by measuring effective vs. used permissions and recommending least-privilege policies.
**Expected outcome** — An IAM audit tool that outputs a report of over-privileged identities, privilege-escalation paths, and concrete least-privilege policy recommendations for a target cloud account.
**Difficulty** — Advanced — requires deep IAM semantics, effective-permission computation, and graph analysis of escalation paths.
**Primary category** — IAM / Identity Security; Secondary = Cloud Security, GRC, CIEM
**Security domains** — Primary = Cloud Security; Secondary = Blue Team, GRC, IAM/Identity Security, Red Team (escalation-path insight)
**Technical focus** — IAM policy analysis, effective-permissions computation, privilege-escalation path detection, CIEM, least-privilege recommendation, unused-access analysis, toxic-combination detection, cross-account trust analysis, identity graph analytics, Zero Trust access
**Core technologies** — Languages: Python, SQL, JSON/IAM policy language; Frameworks/Libraries: AWS SDK/boto3, NetworkX/graph libs, Neo4j/Cypher; Security Tools: AWS IAM Access Analyzer/Access Advisor, CloudTrail, PMapper, Cloudsplaining, Prowler/ScoutSuite, Azure PIM/Entra, GCP IAM Recommender; Cloud/Infra: AWS, Azure, GCP; AI/Data: graph analytics, anomaly detection on access patterns; Databases: Neo4j (graph), PostgreSQL
**Where it's valued** — Any cloud enterprise, finance, healthcare, government, MSSPs, Zero Trust programs, CIEM adopters
**Careers it builds toward** — Cloud Security Engineer, IAM/Identity Security Engineer, CIEM Specialist, Cloud Security Architect, GRC Engineer, Penetration Tester (cloud)
**Framework alignment**
• MITRE ATT&CK: Valid Accounts: Cloud Accounts T1078.004, Account Manipulation T1098 (T1098.001 Additional Cloud Credentials, T1098.003 Additional Cloud Roles), Abuse Elevation Control Mechanism T1548, Permission Groups Discovery: Cloud Groups T1069.003, Cloud Infrastructure Discovery T1580, Unsecured Credentials T1552
• NIST CSF 2.0: Identify, Protect (primary), Govern; strongly aligned to NIST SP 800-207 Zero Trust
• OWASP: OWASP API Security Top 10 — API1 Broken Object Level Authorization, API5 Broken Function Level Authorization (identity/authorization relevance)
• CIS Controls v8: 5 Account Management, 6 Access Control Management (incl. least privilege), 3 Data Protection, 4 Secure Configuration
**Innovation** — Innovative Product — graph-based effective-permission and escalation-path analysis with least-privilege recommendations sits squarely in the fast-growing CIEM market and is highly differentiating. Scores: Innovation 8/10, Startup 8/10, Enterprise-Readiness 8/10, Patent = Possible.