iam-audit-lab

About the Project

IAM Audit Lab is a powerful auditing platform designed to analyze and assess Identity and Access Management configurations across cloud (AWS, Azure, GCP) and on-premises environments. IAM is the security discipline that ensures the right people and services have the right level of access to the right resources — and nothing more. This principle, known as 'least privilege,' is fundamental to preventing unauthorized access and limiting the blast radius of security breaches. The platform performs deep analysis across several critical dimensions: Privilege Analysis identifies users, roles, and service accounts with permissions that exceed their actual operational needs — a condition known as 'privilege creep' that naturally occurs as employees change roles or projects over time. Orphan Account Detection finds accounts belonging to former employees, decommissioned services, or test environments that were never properly cleaned up — each representing an unmonitored entry point for attackers. Policy Compliance Verification checks IAM configurations against industry benchmarks (CIS, NIST) and organizational policies, flagging deviations that increase risk. The lab generates detailed reports showing exactly which permissions are excessive, why they pose a risk, and specific remediation steps including the minimal IAM policies needed for each user or service. Reports are available in HTML (for human review), JSON (for automation), and CSV (for spreadsheet analysis). For organizations managing hundreds or thousands of IAM entities across multiple cloud providers, the lab provides a unified view of identity risk, enabling security teams to prioritize remediation efforts where they will have the greatest impact.

Why This Matters

Identity and Access Management misconfigurations are consistently ranked as the number one cause of cloud security breaches. According to multiple industry reports, over 90% of cloud accounts have excessive permissions, and the average organization has hundreds of inactive accounts that could be compromised. High-profile breaches at major companies have repeatedly been traced back to overprivileged service accounts, stale credentials, or improperly scoped roles. The challenge is scale — modern cloud environments create IAM entities at unprecedented rates. Each serverless function, container, CI/CD pipeline, and microservice needs its own identity with specific permissions. Manually auditing these configurations is humanly impossible, yet automated tools from cloud providers only cover their own platform, leaving multi-cloud organizations with blind spots. This lab fills that gap by providing cross-cloud IAM visibility, automated analysis, and actionable remediation guidance. It transforms IAM auditing from a periodic, manual checklist exercise into a continuous, automated process that catches misconfigurations before they can be exploited.

Step-by-Step Guide

1. Configure read-only access credentials for each cloud environment you want to audit. The lab requires only read permissions (no write access) to analyze IAM configurations. Follow the provider-specific setup guides in /docs/aws-setup.md, /docs/azure-setup.md, and /docs/gcp-setup.md which include the minimal IAM policies needed for the audit account.
2. Run the IAM scanner with the command 'iam-audit scan --provider aws' (or azure, gcp, or 'all' for multi-cloud). The scanner will enumerate all IAM entities, analyze their effective permissions, check against CIS benchmarks, and identify anomalies. A full scan typically takes 5-15 minutes depending on the size of your environment.
3. Review the comprehensive findings report generated in both HTML and JSON formats. The report categorizes findings by severity (critical, high, medium, low), affected resource, and remediation effort. Critical findings include admin-level access on service accounts, MFA not enabled on privileged users, and API keys older than 90 days without rotation.
4. Apply the suggested remediations using the included playbooks. Each finding includes a specific, copy-paste-ready remediation — such as the minimal IAM policy to replace an overprivileged role. Use the 'iam-audit apply --dry-run' command to preview changes before applying them, ensuring no operational disruption.

Technologies Used