System and method of managing privilege escalation in cloud computing environments

An identity and access management system that identifies over-privileged access for a selected identity in a computing system, the identity and access management system comprising:

• at least one memory configured to store instructions;
• and
• at least one processor communicatively connected to the at least one memory and configured to execute the stored instructions to:
• receive configuration information for the computing system;
• determine access privileges to the computing system for the selected identity using at least the received configuration information, the access privileges identifying one or more computing resource or service accessible to the selected identity;
• determine at least one role assumable by the identified one or more computing resource or service accessible to the selected identity;
• determine whether the identified one or more computing resource or service accessible to the selected identity can elevate its privileges by (a) adding a new role assumable by the identified one or more computing resource or service, or (b) modifying the determined at least one role to access an additional resource or service, or both (a) and (b);
• simulate access granted to the selected identity by the added new role or the modified at least one role to identify over-privileged access for the selected identity;
• and
• in a case where it is determined that the identified one or more computing resource or service accessible to the selected identity can elevate its privileges, provide notification of the identified over-privileged access to the computing system.

A non-transitory computer readable storage medium storing a program executable by a processor to perform a method of identifying over-privileged access for a selected identity in a computing system, the method comprising:

• receiving configuration information for the computing system;
• determining access privileges to the computing system for the selected identity using at least the received configuration information, the access privileges identifying one or more computing resource or service accessible to the selected identity;
• determining at least one role assumable by the identified one or more computing resource or service accessible to the selected identity;
• determining whether the identified one or more computing resource or service accessible to the selected identity can elevate its privileges by (a) adding a new role assumable by the identified one or more computing resource or service, or (b) modifying the determined at least one role to access an additional resource or service, or both (a) and (b);
• simulating access granted to the selected identity by the added new role or the modified at least one role to identify over-privileged access for the selected identity;
• and
• in a case where it is determined that the identified one or more computing resource or service accessible to the selected identity can elevate its privileges, providing notification of the identified over-privileged access to the computing system.