Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

IAM Drift | Access Recertification Engine

Permission drift analyser that compares granted entitlements against 90 days of observed usage per identity, surfacing dormant accounts with live credentials, wildcard grants, IAM self-escalation paths, and the specific permissions safe to remove.

Live demo readyIAM + Least Privilege
IAMLeast PrivilegeAccess ReviewCloud SecurityComplianceIdentity GovernanceCase study / interactive demo

Case study

From problem to working system

Problem

Permission drift analyser that compares granted entitlements against 90 days of observed usage per identity, surfacing dormant accounts with live credentials, wildcard grants, IAM self-escalation paths, and the specific permissions safe to remove.

My role

Security engineer and full-stack developer

Solution

Permission drift analyser that compares granted entitlements against 90 days of observed usage per identity, surfacing dormant accounts with live credentials, wildcard grants, IAM self-escalation paths, and the specific permissions safe to remove.

Architecture

The implementation combines the following technologies and system concerns.

IAMLeast PrivilegeAccess ReviewCloud SecurityComplianceIdentity Governance

How it was built

  • Turned a subjective access review into arithmetic by differencing granted permissions against permissions actually exercised in the log window.
  • Expanded wildcard grants when matching against observed usage, so s3:* is credited only for the specific calls that were made.
  • Flagged identities belonging to offboarded people and service accounts dormant past 90 days, which are the two findings that open most audit reports.
  • Detected IAM self-escalation paths such as PassRole and CreateAccessKey, where least privilege quietly becomes administrative access.

Security decisions

  • Turned a subjective access review into arithmetic by differencing granted permissions against permissions actually exercised in the log window.
  • Flagged identities belonging to offboarded people and service accounts dormant past 90 days, which are the two findings that open most audit reports.
  • Detected IAM self-escalation paths such as PassRole and CreateAccessKey, where least privilege quietly becomes administrative access.

Major challenges

  • Turned a subjective access review into arithmetic by differencing granted permissions against permissions actually exercised in the log window.
  • Expanded wildcard grants when matching against observed usage, so s3:* is credited only for the specific calls that were made.
  • Flagged identities belonging to offboarded people and service accounts dormant past 90 days, which are the two findings that open most audit reports.

Verified evidence

Results and measurable impact

  • Flagged identities belonging to offboarded people and service accounts dormant past 90 days, which are the two findings that open most audit reports.
  • Detected IAM self-escalation paths such as PassRole and CreateAccessKey, where least privilege quietly becomes administrative access.
  • Reported a per-identity drift ratio so right-sizing can be prioritised by how much excess access each identity holds.
  • Paired every finding with the remediation and the review cadence, because access review without a next cycle is a snapshot, not a control.

No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

IAM Drift

Security platform

IAM DriftWorkspace2 updates
IAM Drift · Access Recertificationmean share of granted permission never exercised
8 high · drift 58%

Permission drift is the gap between what an identity was granted and what it has actually exercised. Comparing grants against 90 days of access logs turns a subjective access review into arithmetic, and it surfaces the two findings that matter most: dormant identities with live credentials, and self-escalation paths through IAM.

Identities

5

3 privileged

High findings

8

disable or constrain now

Dormant

2

no login in 90 days

Mean drift

58%

granted but unused

Mean drift5 identities
58%unused
Drift per identity, worst firstgranted vs exercised

Marked bars are identities dormant past 90 days. Full drift on a dormant account is an account to disable, not to right-size.

Recertification queue5 shown
d.silvaFormer contractoroffboarded214d idle
Unused grants3 of 3

Identity belongs to an offboarded person but is still enabled. Disable immediately and reassign any owned resources. This is the finding auditors open with.

svc-legacy-backupRetired service accountprivileged480d idle
Unused grants3 of 3

No authentication in 480 days. Disable the identity. A dormant account with live credentials is pure attack surface.

1 wildcard grant(s): s3:*. Replace with the specific actions the access logs show being used.

Holds a self-escalation path through IAM. Constrain to specific role ARNs and gate behind a permissions boundary.

100% of grants unused in 90 days: s3:*, kms:Decrypt, iam:CreateAccessKey. Right-size to observed usage and re-review in one cycle.

j.harlowIT Directorprivileged2d idle
Unused grants3 of 6

4 wildcard grant(s): iam:*, s3:*, ec2:*, rds:*. Replace with the specific actions the access logs show being used.

Holds a self-escalation path through IAM. Constrain to specific role ARNs and gate behind a permissions boundary.

50% of grants unused in 90 days: iam:*, rds:*, kms:Decrypt. Right-size to observed usage and re-review in one cycle.

svc-deployCI service accountprivileged0d idle
Unused grants2 of 5

1 wildcard grant(s): ecr:*. Replace with the specific actions the access logs show being used.

Holds a self-escalation path through IAM. Constrain to specific role ARNs and gate behind a permissions boundary.

m.tanAnalyst1d idle
Unused grants0 of 3

Granted permission matches observed usage. No action. Keep on the standard recertification cycle.

Zain Khalil Khan