Detection of over-privileged access permissions

An apparatus for managing system resources, the apparatus comprising:

• a storage device configured to store a security rule;
• and
• a processor communicatively coupled to the storage device and configured to perform operations comprising:
• evaluating whether a name of a system resource defined in a first security policy is an allowable name for the system resource defined in the security rule to obtain a first evaluation result;
• evaluating whether a name of a role defined in a second security policy is an allowable name for the role defined by the security rule to obtain a second evaluation result;
• determining whether the role has an over-privileged access permission contained in a set of effective access permissions based on the first evaluation result and the second evaluation result;
• identifying, based on the determining, a third security policy, related to the first security policy and the second security policy, that would also generate the over-privileged access permission, wherein the identifying is performed before requesting access to the system resource using the over-privileged access permission;
• labeling the first security policy, the second security policy, and the third security policy as non-compliant;
• and
• restricting the role from transmitting requests for system resources in response to labeling the first security policy, the second security policy, and the third security policy as non-compliant.

A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising:

• evaluating whether a name of a system resource defined in a first security policy is an allowable name for the system resource defined in a security rule to obtain a first evaluation result;
• evaluating whether a name of a role defined in a second security policy is an allowable name for the role defined in the security rule to obtain a second evaluation result;
• determining whether the role has an over-privileged access permission contained in a set of effective access permissions based on the first evaluation result and the second evaluation result;
• identifying, based on the determining, a third security policy, related to the first security policy and the second security policy, that would also generate the over-privileged access permission, wherein the identifying is performed before requesting access to the system resource using the over-privileged access permission;
• labeling the first security policy, the second security policy, and the third security policy as non-compliant;
• and
• restricting the role from transmitting requests for system resources in response to labeling the first security policy, the second security policy, and the third security policy as non-compliant.