Cloud Permission Analyzer
Identify over-privileged IAM roles and service accounts in AWS, Azure, and GCP. Get least-privilege recommendations without connecting to your cloud account.
- Supports AWS IAM, Azure RBAC, and GCP IAM policy formats
- Detects wildcarded permissions, privilege escalation paths, and logging-disable risks
- Risk-ranked findings with specific least-privilege alternatives
- No credentials or API access required — paste JSON only
Analysis findings
5 findings · 1 CriticalAdministratorAccess policy attached
Fix: Scope to required S3 buckets and Glue actions only
iam:PassRole to any resource (*)
Fix: Restrict PassRole to specific Lambda execution roles
s3:GetObject on * — exposes all bucket contents
Fix: Scope to function's specific input bucket ARN
cloudtrail:StopLogging permission included
Fix: Remove — breaks principle of least privilege
kms:Decrypt on 3 unrelated keys
Fix: Scope to backup-specific KMS key ARN
How this tool works
Paste your IAM policy JSON or role ARN list
Input your AWS IAM policy documents, Azure role definitions, or GCP IAM bindings as JSON. The tool does not require API access to your account.
Select your cloud provider and analysis scope
Choose AWS, Azure, or GCP. Select whether to check all permissions or focus on high-risk permission categories (admin, data exfiltration paths, logging tampering).
Review findings and least-privilege recommendations
Each over-privileged role is listed with the specific dangerous permission, risk severity, and a recommended least-privilege alternative policy statement.
What to do with the result
Prioritise by risk
Focus on Critical and High findings first — these represent roles with lateral movement or data exfiltration potential.
Export remediation tickets
Export findings as a Jira-compatible CSV or a structured remediation report for your cloud operations team.
Recheck after access reviews
Re-run the analysis after each quarterly access review to validate that scoping changes were applied correctly.
Cloud permission analyzer: frequently asked questions
Does this tool connect to my AWS, Azure, or GCP account?
No. The free tool is entirely static — you paste policy JSON or role definitions manually. No API keys, credentials, or cloud console access are required. Nothing is transmitted to ManySignal.
What permission patterns does the analyzer flag as high risk?
Critical: wildcarded admin policies (AdministratorAccess, Owner, roles/owner), iam:PassRole to *, logging-disable permissions (cloudtrail:StopLogging, logging.sinks.delete). High: S3/Storage access to *, database Admin, iam:CreateUser, iam:AttachUserPolicy. Medium: cross-account trust configurations, long-lived access key dependencies.
Which cloud providers are supported?
The current version supports AWS IAM (JSON policy document format), Azure RBAC (role definition JSON), and GCP IAM (binding JSON from gcloud iam roles describe). Kubernetes RBAC support is in beta.
How does this differ from AWS IAM Access Analyzer?
AWS IAM Access Analyzer focuses on external access findings (policies granting access outside your account). This tool focuses on over-privileged permissions within your account, including wildcarded actions and resources, and applies cross-cloud rules not available in native cloud tools.
Can I analyze service account permissions in GCP?
Yes. Paste your GCP IAM bindings JSON (from gcloud projects get-iam-policy) and select GCP as your provider. The analyzer evaluates bindings for both user accounts and service accounts.
How should I prioritise remediation if I have 50+ findings?
Sort by risk level (Critical first) and then by the role's blast radius — roles assumed by external-facing applications or with cross-account trust are higher priority than internal service roles. The analyzer estimates blast radius based on trust policy analysis.
Does the tool check for privilege escalation paths?
Yes. The analyzer identifies known privilege escalation permission combinations (iam:CreatePolicyVersion + iam:SetDefaultPolicyVersion, iam:AttachUserPolicy + iam:CreateAccessKey, etc.) and flags them as Critical regardless of the individual permission's apparent risk.
What is the recommended cadence for running this analysis?
Monthly at minimum, and after any IAM change event (new role created, policy attached, cross-account trust added). High-security environments run weekly. Integrate with your CI/CD pipeline using ManySignal's platform API to block role deployments that introduce Critical findings.
Detect IAM abuse in real time, not quarterly
ManySignal monitors IAM activity continuously and alerts on privilege escalation, anomalous assume-role patterns, and policy changes. Book a demo.