Home / Knowledge hub / Overly permissive IAM
Knowledge hub
Overly permissive IAM
Cloud permissions broader than a job needs, so one leak reaches far.
What it means
Identity and access management, or IAM, controls who and what can do things in your cloud account. Overly permissive IAM is when a user, role or service has more permissions than its work needs. A function that reads one storage folder is allowed to read all storage, or to do anything at all.
Wildcards are the usual cause: permission to perform any action on any resource, written because it was quicker than working out the exact list. It is the cloud form of breaking the principle of least privilege.
Why it matters
The permissions decide how far a single mistake travels. If an application is compromised through a flaw such as SSRF, or a key leaks, the attacker gets whatever that identity could do. A narrow role means a small incident. A broad role means access to databases, backups and other accounts.
Broad permissions also make privilege escalation easy, since some permissions let an identity grant itself more. Investigations get harder because every identity could have done everything.
How it shows up
You meet it in roles attached to servers and functions, access keys given to developers and pipelines, third-party integrations and shared admin groups. Warning signs include policies containing * for actions or resources, long-unused permissions, and a pipeline role that is effectively an administrator.
Start from nothing and add what is needed. Use separate roles for separate jobs, prefer short-lived credentials, review access regularly and remove unused permissions. Your provider's analysis tools show which permissions were actually used, which makes trimming safer. Check the roles behind every public-facing service first.
Questions people ask
Overly permissive IAM, answered
What is the difference between IAM and access control in my app?
IAM governs who can act on your cloud resources. Application access control governs what users can do inside your software. Both need least privilege, and weakness in either can lead to the same data.
Why are wildcards a problem?
A wildcard grants more than anyone planned. New services and actions that appear later may also be covered. A specific list is longer to write but limits the damage.
How do I find over-broad permissions?
List policies with wildcards, review who holds administrator rights, and use the provider's tools that show unused permissions. Start with identities exposed to the internet.
Does multi-factor authentication fix it?
It protects the sign-in of a person. It does nothing for a role used by a server or a leaked key. Narrow permissions and short-lived credentials cover those.
How does this relate to a web app test?
If a flaw gives access to the server, the role it carries decides the impact. Testing shows what the application can be made to do, and review of the role shows how far that reaches.
Sources
Where this comes from
Related
Terms that sit next to this one
IAM role
A set of cloud permissions that a person or service can temporarily assume.
Least privilege
Giving every person and service the minimum access the job requires.
Cloud privilege escalation
Using a small cloud permission to gain a much larger one inside the same account.
Cloud credentials leak
Cloud access keys exposed in code, images or logs and then used by others.
Identity and access management (IAM)
The tools and rules that manage who your people and services are and what they reach.
How far does one leaked key reach?
When a flaw in your app hands over a server's identity, the permissions behind it decide the impact. We prove what the flaw allows, with the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.