Cloud security platform with contextual hot-spot permissions analytics

A computer program product in a non-transitory computer-readable medium, the computer program product holding computer program instructions that, when executed by a processor in a host processing system, identify cloud identities in an enterprise that are propagating permissions within a public cloud environment, the public cloud environment associated with a set of cloud deployments, and wherein the enterprise has an associated set of cloud accounts hosted in the set of cloud deployments, the computer program instructions configured to:

• for each identity in a set of one or more identities, determine a set of permissions;
• determine, for each identity, and based on a set of identity chains, a set of identity account action paths (IAAPs), wherein an identity chain for a given identity is a list comprising the given identity and one or more other identities used to gain a given permission, and wherein an IAAP of the set defines how the given identity obtains an ability to perform a given action in a given account;
• use the identity account action paths to identify one or more cloud identities in the enterprise that are propagating permissions within the public cloud environment;
• and
• responsive to identification of the one or more cloud identities, provide signaling to a security system to take a given action.