System and method for detecting excessive permissions in identity and access management
A system and method for detecting excessive permissions of a principal in a cloud computing environment utilizes code objects of infrastructure as code. The method also includes accessing a configuration code, the configuration code including a plurality of code objects, where a code object of the plurality of code objects corresponds to a deployed principal in the cloud computing environment; detecting in a log a plurality of access events, each access event associated with a first principal deployed in the cloud computing environment based on a first code object of the plurality of code objects; determining that the first code object includes a permission which is not utilized in any of the plurality of access events; and initiating a mitigation action for the first principal based on the permission.
1. A method for detecting excessive permissions of a principal in a cloud computing environment, comprising:
accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a deployed principal in the cloud computing environment;
detecting in a log a plurality of access events, each access event associated with a first principal deployed in the cloud computing environment based on a first code object of the plurality of code objects;
determining that the first code object includes a permission which is not utilized in any of the plurality of access events; and
initiating a mitigation action for the first principal based on the permission.
2. The method of claim 1 , further comprising:
revoking the permission from the first principal.
3. The method of claim 1 , further comprising:
generating any one of: a notification, an alert, and a combination thereof, in response to determining that the first code object includes a permission which is not utilized in any of the plurality of access events.
4. The method of claim 1 , further comprising:
generating an updated first code object, based on the first code object, and a permission utilized in any of the plurality of access events.
5. The method of claim 4 , further comprising:
generating an updated configuration code based on replacing the first code object with the updated first code object.
6. The method of claim 4 , further comprising:
generating a new role including each permission detected in the plurality of access events; and
generating the updated first code object based on the first code object and the new role.
7. The method of claim 1 , wherein the log is any one of: a cloud log, a network log, an event log, and any combination thereof.
8. The method of claim 1 , wherein each access event corresponds to an access of a resource in the cloud computing environment.
9. The method of claim 8 , wherein the resource is any one of: a repository, a database, a bucket, a hosted application, a virtual machine, a software container, a serverless function, an appliance, and any combination thereof.
10. The method of claim 1 , wherein the log includes a plurality of data records, each data record including a plurality of values which are written to the log based on an event in the cloud computing environment.
11. The method of claim 1 , wherein each of the plurality of access events corresponds to a permission associated with the first code object.
12. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a deployed principal in the cloud computing environment;
detecting in a log a plurality of access events, each access event associated with a first principal deployed in the cloud computing environment based on a first code object of the plurality of code objects;
determining that the first code object includes a permission which is not utilized in any of the plurality of access events; and
initiating a mitigation action for the first principal based on the permission.
13. A system for detecting excessive permissions of a principal in a cloud computing environment, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
access a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a deployed principal in the cloud computing environment;
detect in a log a plurality of access events, each access event associated with a first principal deployed in the cloud computing environment based on a first code object of the plurality of code objects;
determine that the first code object includes a permission which is not utilized in any of the plurality of access events; and
initiate a mitigation action for the first principal based on the permission.
14. The system of claim 13 , wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to:
revoke the permission from the first principal.
15. The system of claim 13 , wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to:
generate any one of: a notification, an alert, and a combination thereof, in response to determining that the first code object includes a permission which is not utilized in any of the plurality of access events.
16. The system of claim 13 , wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to:
generate an updated first code object, based on the first code object, and a permission utilized in any of the plurality of access events.
17. The system of claim 16 , wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to:
generate an updated configuration code based on replacing the first code object with the updated first code object.
18. The system of claim 16 , wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to:
generate a new role including each permission detected in the plurality of access events; and
generate the updated first code object based on the first code object and the new role.
19. The system of claim 13 , wherein the log is any one of: a cloud log, a network log, an event log, and any combination thereof.
20. The system of claim 13 , wherein each access event corresponds to an access of a resource in the cloud computing environment.
21. The system of claim 20 , wherein the resource is any one of: a repository, a database, a bucket, a hosted application, a virtual machine, a software container, a serverless function, an appliance, and any combination thereof.
22. The system of claim 13 , wherein the log includes a plurality of data records, each data record including a plurality of values which are written to the log based on an event in the cloud computing environment.
23. The system of claim 13 , wherein each of the plurality of access events corresponds to a permission associated with the first code object.