Assessment domain
Identity & access (IAM)
Identity is the control plane of the cloud. Almost every serious cloud breach runs through an identity that had more access than it needed, a credential that should have been rotated, or a trust relationship nobody remembered creating. It is the first thing we assess, because it is the first thing an attacker looks for.
Why it matters
Where the risk lives
In the cloud there is no network perimeter to hide behind — access is identity. Over-permissioned roles, long-lived keys, and missing MFA turn a single phished credential or leaked token into full-account compromise. Getting identity right is the highest-leverage work in cloud security, and it is where findings most often map straight to SOC 2, HIPAA, PCI-DSS, and CIS controls.
What we assess
The checks inside identity & access
Each area below is a focused review with its own findings, per-cloud detail, and remediation.
Over-privileged roles & policies
Roles and policies drift toward “just make it work,” accumulating permissions nobody audits. Wildcards (*:*), broad managed-admin policies, and unused grants widen the blast radius of any compromise. We measure the gap between what identities can do and what they actually use.
What we look forStale & long-lived credentials
Static keys that never expire are the credential most likely to leak and least likely to be noticed. Old access keys, unrotated service-account keys, and dormant users are standing liabilities.
What we look forMissing or weak MFA
Multi-factor authentication is the single highest-return control against credential theft. Gaps concentrate on the accounts that matter most — root/owner, break-glass, and privileged human users.
What we look forRisky trust & cross-account access
Trust policies and cross-account roles are how workloads talk to each other — and how attackers pivot. Confused-deputy conditions and over-broad trust turn one account’s compromise into many.
What we look forFederation, SSO & identity providers
Most enterprises federate cloud access through an identity provider. Misconfigured federation, orphaned direct logins, and weak group-to-role mappings undermine the whole model.
What we look forSecrets management
Secrets sprawl — in environment variables, parameter stores, repos, and images — is where identity and data risk meet. Unmanaged secrets are credentials waiting to leak.
What we look forAcross your clouds
AWS, Azure & Google Cloud
AWS
IAM users, roles, policies, and access keys; root account posture; STS trust policies; IAM Access Analyzer and Access Advisor for unused-access evidence.
Azure
Entra ID (Azure AD) roles and RBAC assignments; managed identities; Conditional Access and MFA posture; service principals and app registrations.
Google Cloud
Cloud IAM roles and bindings; service accounts and keys; org-policy constraints; Policy Analyzer / Recommender for over-grant and unused access.
Example finding
A CI service role with AdministratorAccess and a 2-year-old key
Risk: A leaked pipeline key would grant full account control — the single credential most likely to end up in a public repo or build log.
Fix: Scope the role to the exact deploy actions in use, rotate to short-lived OIDC tokens, and remove the standing static key.
Questions
Do you need write access to assess identity?
No. The identity assessment is read-only — we review roles, policies, keys, and trust relationships without changing any of them or touching production.
Is this just a permissions dump?
No. A raw permissions export is noise. We rank findings by the real exposure they create — an over-privileged production role beats a dormant sandbox user — and give you an order to fix them in.
How does identity map to compliance?
Identity findings map directly to CIS IAM benchmarks, SOC 2 access controls, HIPAA access management, and PCI-DSS Requirement 7/8 — so the same work produces audit evidence.
See where you stand on identity & access
A health check finds and prioritizes real exposure. It is not a certification or a promise you will never be breached — closing the findings is what changes your risk.
Related domains
The rest of the health check
One read-only assessment covers all six domains — here's where else exposure tends to hide.
