Dynamically adjusting access policies

A computer-implemented method performed by one or more processors of a computing system for managing an access policy of a system identity, the method comprising:

• generating, by the computing system, a restricted access policy for the system identity based on a first set of access logs, wherein the restricted access policy comprises access privileges for resources;
• determining, by the computing system, a first subsequent access denied error for the system identity;
• determining, by the computing system, whether the first subsequent access denied error is in an ignore list corresponding to the system identity, wherein the ignore list comprises a list of access denied errors which the computing system will ignore for further analysis;
• responsive to determining, by the computing system, that the first subsequent access denied error is not in the ignore list, determining, by the computing system, whether to add the first subsequent access denied error to the ignore list;
• responsive to determining, by the computing system, to add the first subsequent access denied error to the ignore list, adding, by the computing system, the first subsequent access denied error to the ignore list;
• determining, by the computing system, a second subsequent access denied error for the system identity;
• determining, by the computing system, that the second subsequent access denied error is not in the ignore list and to not add the second subsequent access denied error to the ignore list;
• responsive to determining, by the computing system, to not add the second subsequent access denied error to the ignore list, determining, by the computing system, whether the system identity is authorized to perform an action corresponding to the access denied error;
• and
• responsive to determining, by the computing system, that the system identity is authorized to perform the action, updating, by the computing system, the restricted access policy to include an access privilege corresponding to the action.

A non-transitory computer-readable storage medium storing computer program instructions executable by one or more processors of a computing system for managing an access policy of a system identity, the computer program instructions comprising instructions to:

• generate, by the computing system, a restricted access policy for the system identity based on a first set of access logs, wherein the restricted access policy comprises access privileges for resources;
• determine, by the computing system, a first subsequent access denied error for the system identity;
• determine, by the computing system, whether the first subsequent access denied error is in an ignore list corresponding to the system identity, wherein the ignore list comprises a list of access denied errors which the computing system will ignore for further analysis;
• responsive to determining, by the computing system, that the first subsequent access denied error is not in the ignore list, determine, by the computing system, whether to add the first subsequent access denied error to the ignore list;
• responsive to determining, by the computing system, to add the first subsequent access denied error to the ignore list, add, by the computing system, the first subsequent access denied error to the ignore list;
• determine, by the computing system, a second subsequent access denied error for the system identity;
• determine, by the computing system, that the second subsequent access denied error is not in the ignore list and to not add the second subsequent access denied error to the ignore list;
• responsive to determining, by the computing system, to not add the second subsequent access denied error to the ignore list, determine, by the computing system, whether the system identity is authorized to perform an action corresponding to the access denied error;
• and
• responsive to determining, by the computing system, that the system identity is authorized to perform the action, update, by the computing system, the restricted access policy to include an access privilege corresponding to the action.