Skip to content
Cloud SecurityDeskSearch
Menu

Publications / Research report

Research report · Identity & access

The permission path you didn’t review

Cross-account trust rarely fails at the obvious policy. The risk lives in the path between identities, conditions, and inherited access.

Key findings

  1. A trusted principal is not the same thing as a trusted permission path.
  2. Conditions lose protective value when later hops do not preserve their context.
  3. Reviewers need a graph of reachable roles, not a folder of isolated policies.

Demonstration publication. The scenario and all numerical data are illustrative, not observed research findings.

By
Umair Akbar and Ahmed Elshekh
Published
Revised
Reading time
12 minutes
Coverage
AWS

An illustrative examination of how AWS role chains can turn individually reasonable trust decisions into an unexpected effective permission path.

Finding the path

A role can look appropriately constrained when it is reviewed alone. The useful question is whether another identity can reach it, what context survives the hop, and what the destination role can reach next.

For this demonstration, we model a fictional engineering account, shared services account, and production account. Nothing here describes a measured customer environment; the scenario exists to make the review method concrete.

Figure 01 · Illustrative dataset

Review coverage across the permission path

The illustrative review sees most direct policies but less than half of inherited paths and session context.

Horizontal bars show direct policies at 91 percent, trust conditions at 78 percent, inherited paths at 44 percent, and session context at 31 percent.

View accessible data table
Review coverage across the permission path
CategoryControls observed
Direct policies91%
Trust conditions78%
Inherited paths44%
Session context31%

Source Cloud Security Desk demonstration dataset

Method Four fictional review domains scored against a synthetic 100-control environment. Values demonstrate presentation only and are not research findings.

Download source data (CSV) ↓

Conditions only work in context

Source identity, external IDs, organization constraints, and session tags can narrow a trust decision. They do not automatically travel through every subsequent role assumption. A reviewer should record where context is introduced, transformed, and discarded.

  • Enumerate principals that can start a session.
  • Resolve every reachable role and resource policy.
  • Test whether each intended condition survives the full chain.

A reviewable output

The finished review should identify the initiating identity, each hop, the maximum session duration, preserved context, effective actions, and a named owner. Exceptions should explain the operational reason for the path and its expiry condition.

That format turns an abstract IAM discussion into evidence an engineer, auditor, and incident responder can use together.

References

  1. AWS IAM policy evaluation logic
  2. AWS role chaining

From the desk

About the authors

Every Cloud Security Desk publication is authored by Umair Akbar and Ahmed Elshekh, the publication’s owners and chief editors.

Owner & Chief Editor

Umair Akbar

Editorial biography forthcoming.

Owner & Chief Editor

Ahmed Elshekh

Editorial biography forthcoming.