Efficient identification and remediation of excessive privileges of identity and access management roles and policies

A system for an efficient configuration compliance verification of resources in a large computing environment having a plurality of persona, the system comprising:

• a computer network;
• and
• a plurality of resources across the computer network, the plurality of resources comprising a plurality of data processing devices and components associated therewith executing across the plurality of data processing devices, at least one data processing device of the plurality of data processing devices comprising a hardware processor configured to:
• derive a Machine-Readable Role Definition (MRRD) from a description by extracting one of a keyword and a statement from the description, wherein the keyword and the statement is related to at least one of a service action and an access level of an Identity and Access Management (IAM) role, wherein the description is in a natural language comprising a human readable job description;
• generate a Role Potential Excessive Service Action List (RPESAL) for the Identity and Access Management (IAM) role by comparing the Machine-Readable Role Definition (MRRD) with Cloud Provider Service Action Access Reference List;
• generate a Role Actual Excessive Service Action List (RAESAL) for the Identity and Access Management (IAM) role by comparing the Machine-Readable Role Definition (MRRD);
• and
• continuously track and determine at least one of an event and a change to the description and update the MRRD dynamically when at least one of the event and the change to the description captured in the natural language is determined,
• wherein the event comprises one of a first activity related to modifying the description, and a second activity triggered by a polling process to periodically check and verify the modified description to appropriately update the MRRD, RPESAL and RAESAL respectively as needed.

A non-transitory storage medium, readable through at least one data processing device of a computing system and comprising instructions embodied therein, with the instructions configured to execute on the at least one data processing device for an efficient configuration compliance verification of resources in a large computing environment having a plurality of persona, the non-transitory storage medium comprising the instructions to:

• derive a Machine-Readable Role Definition (MRRD) from a description by extracting one of a keyword and a statement from the description, wherein the keyword and the statement is related to at least one of a service action and an access level of an Identity and Access Management (IAM) role, wherein the description is in a natural language comprising a human readable description;
• generate a Role Potential Excessive Service Action List (RPESAL) for the Identity and Access Management (IAM) role by comparing the Machine-Readable Role Definition (MRRD) with Cloud Provider Service Action Access Reference List;
• generate a Role Actual Excessive Service Action List (RAESAL) for the Identity and Access Management (IAM) role by comparing the Machine-Readable Role Definition (MRRD);
• and
• continuously track and determine at least one of an event and a change to the description and update the MRRD dynamically when at least one of the event and the change to the description captured in the natural language is determined,
• wherein the event comprises one of a first activity related to modifying the description, and a second activity triggered by a polling process to periodically check and verify the modified description to appropriately update the MRRD, RPESAL and RAESAL respectively as needed.