The IAM Graph Nobody Can Understand
Permissions as a graph: principals, roles, policies, resources — overlap, unused grants, escalation paths.
IAM complexity is discussed in architecture reviews and post-mortems, often as a reliability topic or a FinOps exercise. The conversation stops at policy slides. Constrange's Observe → Measure → Model series treats it as an engineering economics problem: what does the system actually do, what does that work cost, and what model explains the gap between intent and invoice.
Observe: export principals, roles, policies, and resource bindings. Draw the graph — overlap appears quickly.
Measure: count unused permissions, cross-account assumable roles, and admin-equivalent paths.
Model: risk scales with graph connectivity, not policy count. One assumable admin role connects many nodes.
Permissions are topology
IAM consoles list policies. Attackers and auditors think in paths. Service A assumes role B with s3:* on bucket C. Developer D can assume A for debugging. The graph nobody draws is the graph that matters in breach and compliance.
Overlap and drift
- Duplicate policies with different names
- Wildcard resources on production roles
- Unused grants never revoked after migrations
- Break-glass roles without expiry or monitoring
- CI roles with broader scope than deploy requires
| Question | Bad answer | |
|---|---|---|
| Last used? | Unknown | Grant stands forever |
| Assumable by? | Everyone in account | Lateral movement |
| Resource scope | * | Blast radius entire estate |
Graph-first governance
- Generate effective permission graph per service
- Remove grants with no access in 90 days
- Require justification for wildcards
- Alert on new assumable admin paths
“IAM lists are inventories. IAM graphs are risk models.”Constrange
Questions for your next review
- What would we see if we measured IAM graph for one week?
- Which dependency owns the majority of the cost or delay?
- What policy or architecture assumption does the data contradict?
- What is the smallest experiment that would change our model?
The organisations that improve IAM graph are not those with the best slogans. They are those that observe honestly, measure without vanity metrics, and update the model when the bill or the trace disagrees with the diagram.
Frequently asked questions
Why is IAM a graph?
Principals assume roles bound to policies on resources — edges multiply with teams and services.
How do I find unused permissions?
Compare policy grants to CloudTrail or audit logs — last accessed vs granted.
What is privilege escalation path?
A chain of assumable roles and policies that grants more than any single policy shows.
Where do we start?
Graph one production service's effective permissions and remove unused grants.