Skip to main content
{ Identity and Access / Reporting and Compliance }

Cloud IAM Posture Report

Delivers a weekly report across AWS, Google Cloud, and Azure on standing administrator access, idle non-human principals and keys, external and public bindings, and the privileged assignments that changed since last week, with who made each change.

What this agent does

This read-only agent reports every week on identity posture across the cloud accounts I connect. For each cloud, it counts the principals with standing administrator access, the non-human principals and keys idle in the window, and the bindings that grant access to the public or to principals outside the organization. It checks the root and break-glass accounts for MFA. It lists the privileged assignments created, changed, or removed since last week and who made each change. It compares with the previous week and leads with the trend and the changes.

The challenge

Standing administrator access grows one exception at a time, across three clouds, and nobody sees the week the Owner count doubled. A key created for a demo is still active a year later. A bucket policy trusts a vendor account after the contract ends. Each cloud's console shows its own number on its own page. Nobody sees the three trends together, and nobody sees who made each privileged change this week.

The solution

The agent reads each cloud's identity data in one pass each week and defines each count the same way in all three clouds. It names each privileged change since last week with who made it. It reports a count it cannot read as not available, never as zero. Provides a weekly briefing with the fix for each item.

Workflow

  1. 01

    Count standing administrators

    Count the principals with permanent administrator-level access in each cloud, by principal type.

  2. 02

    Count idle access

    Count the non-human principals and the keys with no authentication in the window in each cloud.

  3. 03

    Count external access

    Count the resource policies and bindings that grant access to the public or to principals outside the organization.

  4. 04

    Check root and break-glass accounts

    Check each root and break-glass account for MFA, and pass a member account whose root credentials were removed.

  5. 05

    Read changes

    Read each cloud's audit log for privileged assignments created, changed, or removed since last week, with the actor.

  6. 06

    Report

    Publish the counts, the trend, what changed, and what needs action, with the fix for each item.

Agent template 

# Cloud IAM Posture Report

## Measurable outcomes

Every week, the identity lead knows the standing administrator count, the idle access count, and the external access count for each cloud, the trend of each, and who made each privileged change. Track each count per cloud and the open action items on every run.

## Procedure

Once a week, for the AWS organization, the Google Cloud organization, and the Azure tenant I connect, count the principals with standing administrator access. In AWS, that means users and roles with the AdministratorAccess policy or an equivalent wildcard policy, and Identity Center permission set assignments with the same, by account. Leave the reserved roles Identity Center provisions out of the role count. The assignments already count them. In Google Cloud, that means Owner bindings and bindings to the organization administrator and IAM administrator roles at the organization, folder, and project level. In Azure, that means permanent active Owner and User Access Administrator assignments at the management group and subscription scope and permanent active Global Administrator and Privileged Role Administrator assignments. Count them by principal type: user, group, service principal or service account, and guest. Count the idle access in the window of 90 days, unless I set another window, defined the same way in each cloud: non-human principals with no authentication in the window, and keys with no use in the window. In AWS, read the IAM Access Analyzer unused access findings for roles and access keys. In Google Cloud, read the service account insights and the key authentication activity from Policy Analyzer. In Azure, read the service principals with no sign-in from the sign-in activity report. Count the external access. In AWS, read the external access findings and separate public from cross-account. In Google Cloud, count the allUsers and allAuthenticatedUsers bindings and the bindings to principals outside the organization's domains. In Azure, count the role assignments to guest users. Check the AWS root users from the credential report, the Google Workspace super administrators, and the Azure break-glass accounts I name for MFA, and flag each one without it. Pass an AWS member account whose root credentials were removed through centralized root access. Read each cloud's audit log for the privileged assignments created, changed, or removed since last week, and name the actor for each. Flag any new standing administrator assignment. Compare every count with last week's report and with the last 12 weeks, and lead with the trend and what changed. Give every action item the specific fix. Report a count it could not read as not available, never as zero.

## Requirements

It needs read-only access in each cloud: a role with IAM, Access Analyzer, Identity Center, and CloudTrail read access and access to the credential report in AWS, a service account with the Security Reviewer, IAM Recommender Viewer, and Activity Analysis Viewer roles in Google Cloud plus Admin SDK read access to Google Workspace for the super administrator check, and a service principal with Reader on the subscriptions and Microsoft Graph read access to role management, directory objects, authentication methods, and the audit and sign-in logs in Azure, and nothing more. The AWS idle counts need an unused access analyzer, which AWS bills per IAM role and user analyzed. It never changes a principal, a binding, a policy, or an assignment. Reports show counts, accounts, projects, subscriptions, and role names. Principal names appear as stable pseudonyms.