Security playbook · AI Employee: Sig

Cloud IAM Reviews

Zero unused prod IAM roles; least-privilege improving quarterly

Install this playbookBack to marketplace
The problem

Cloud IAM decays into an ungoverned pile. Every service, every developer, every tool needs an IAM role or user — over 3 years that becomes 800 roles nobody remembers creating, half with permissions well beyond what they use. The privilege-inflation is invisible until an incident (compromised role has admin-everywhere), an audit (SOC 2 asks who reviewed these), or a bill spike (permissions-issue-driven API calls costing $40K/month).

At a glance
Trigger
Cron (quarterly)
Approvals
Owner attests; security reviews privileged
What it does
Writes to your systems
Systems
AWS IAM · GCP IAM · Azure AD
How it feels in production

An hour-by-hour walkthrough.

Every night, Sig snapshots every IAM identity across AWS, GCP, and Azure: users, roles, service accounts, groups. For each, it computes: - Attached policies + inline policies (what permissions it has) - Last-used timestamp per permission (CloudTrail / Cloud Audit Logs analysis over 90 days) - Privilege scope (dev / staging / prod, resource types accessed) - Owner (from tag, CloudFormation stack, or Terraform origin) - Risk score (admin permissions, cross-account trust, public-access resources) Sig produces the monthly IAM review packet per team: - Roles owned by the team + their permissions + their usage - Right-sizing recommendations: "Role X has s3:* but only ever used s3:GetObject" → recommend narrower policy - Stale identities: "Role Y hasn't been used in 90 days" → recommend deletion or archival - High-risk findings: "User Z has AdministratorAccess and no MFA" → require MFA or downgrade Team lead reviews. Approves the right-sizings, deletes the stale, or requests review time ("keep active; will re-review next month"). Sig executes approved changes with dry-run + rollback capability, tracks completion, and files the review record for auditor visibility. Quarterly aggregate to CISO: privilege reduction achieved, stale identities removed, risk score trend, unresolved findings.
How it works

Step by step.

  1. 01

    Snapshot IAM state nightly

    Every IAM identity across AWS, GCP, Azure with attached policies, inline policies, group memberships. Snapshot for delta comparison; historical trend from prior snapshots.

    AWS IAM · GCP IAM · Azure RBAC · Snapshot store
  2. 02

    Analyze usage against permissions

    CloudTrail / Cloud Audit Logs / Azure Activity Log over 90 days. For each permission granted, was it used. Right-sizing candidates: permissions granted but never exercised.

    CloudTrail · Cloud Audit Logs · Azure Activity · Usage analyzer
  3. 03

    Compute risk score + owner

    Risk factors: admin permissions, cross-account trust, public-access-granting permissions, MFA absence for humans. Owner from tags / IaC / creation history. No owner = escalate to security ops.

    Risk model · IaC parsing · Tag inspection
  4. 04

    Monthly review packet per team

    Team-scoped: their identities, right-sizing recommendations, stale identities, high-risk findings. One-click approve for suggested changes; explain-in-place for each recommendation.

    Web UI · Slack · Approval flow
  5. 05

    Execute approved changes + audit trail

    Dry-run + rollback for approved changes (right-sizing, deletion). Track completion + verify. Full audit record for auditor visibility. Quarterly aggregate to CISO.

    AWS IAM · GCP IAM · Azure · Rollback · Audit log
Systems and wiring

What you connect to make this run.

AWS IAM · GCP IAM · Azure RBAC

read+write

IAM as source of truth. Read all identities + policies + attachments. Write approved policy changes + identity deletions with dry-run + rollback.

CloudTrail · Cloud Audit Logs · Azure Activity

read

90-day usage analysis. Every API call tied to identity + resource. Usage-driven right-sizing recommendations.

Terraform · CloudFormation · Pulumi

read

IaC as origin story for many roles. Owner attribution + change proposals through PRs to the IaC repo (so team's normal review workflow applies).

Slack · Teams · Approval flow

read+write

Team review interface. Findings + recommendations surfaced with reasoning; approvals + explanations captured; overrides logged with owner.

What changes

Before and after, honestly.

Identities with unused permissions (privilege inflation)
Before
40-70%
After
Under 10%
Stale identities (90+ days unused)
Before
20-45%
After
Under 5%
Time to complete quarterly IAM review
Before
4-8 weeks
After
3-5 business days
Audit findings on IAM controls
Before
5-20 per audit
After
Zero at steady state
Related

Playbooks that pair with this one.

Security

User Access Reviews (UAR)

Same review pattern for application-level access; different plane.

Security

Just-In-Time (JIT) Access

JIT reduces standing privileged access; complements the periodic review.

Security

SOC2 / Vanta Evidence Collection

IAM review is a SOC 2 control; evidence flows from the review record.

Frequently asked

Answers about this playbook.

How does it handle service accounts (no user MFA applicable)?

Service accounts have their own risk model: least-privilege more important, credential rotation critical, cross-account access limited. Different findings applicable; MFA finding suppressed for service accounts by design.

What if the recommended right-sizing breaks something?

Dry-run + rollback support. Approved changes deploy with a monitoring window; any errors trigger rollback + re-analysis. Right-sizing recommendation includes usage evidence so team can spot unusual patterns.

How does it handle federation (SSO to AWS via SAML/Okta)?

Federated identities tracked separately. IAM policies + role assumptions from SSO analyzed for usage. Right-sizing applies at the role level; identity itself managed in Okta / IdP.

What about permissions granted transitively (group membership, role assumption)?

Effective permissions computed across group + assumption chains. Right-sizing considers the full effective set, not just directly-attached policies.

How does it coordinate with our CSPM tool (Wiz, Prisma Cloud)?

CSPM feeds IAM findings as additional signal ("this role has permissions that would allow public S3 bucket creation"). Sig integrates + de-duplicates so security team sees one prioritized list rather than parallel dashboards.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Security playbooks