Analysis of role reachability using policy complements

A method, comprising:

• determining, by an access control analyzer, a first node in a graph, wherein the first node corresponds to a first role in a provider network hosting a plurality of resources, wherein the first role is associated with a first access control policy, and wherein the first access control policy grants or denies access to a first one or more of the resources;
• determining, by the access control analyzer, a second node in the graph, wherein the second node corresponds to a second role in the provider network, wherein the second role is associated with a second access control policy, and wherein the second access control policy grants or denies access to a second one or more of the resources;
• and
• performing, by the access control analyzer, a role reachability analysis that determines whether the first role can assume the second role for a particular state of one or more attributes, the role reachability analysis comprising:
• determining a third access control policy authorizing a negation of a role assumption request for the second role;
• and
• determining whether the first role can assume the second role based at least in part on analysis of the third access control policy with respect to a role assumption policy for the second role for the particular state of the one or more attributes.

One or more non-transitory computer-readable storage media storing program instructions that, when executed on or across one or more processors, perform:

• determining, by an access control analyzer, a first node in a graph, wherein the first node corresponds to a first role in a provider network hosting a plurality of services or resources, wherein the first role is associated with a first access control policy, and wherein the first access control policy grants or denies access to a first one or more of the services or resources;
• determining, by the access control analyzer, a second node in the graph, wherein the second node corresponds to a second role in the provider network, wherein the second role is associated with a second access control policy, and wherein the second access control policy grants or denies access to a second one or more of the services or resources;
• and
• performing, by the access control analyzer, a role reachability analysis that determines whether the first role can assume the second role for a particular state of one or more tags, the role reachability analysis comprising:
• determining a third access control policy authorizing a complement of a role assumption request for the second role;
• and
• determining whether the first role can assume the second role based at least in part on analysis of the third access control policy with respect to a role assumption policy for the second role for the particular state of the one or more tags.