Evaluation of effective access permissions in identity and access management (iam) systems

An apparatus for managing an identity and access management (IAM) system, the apparatus comprising:

• a storage device configured to store a set of security policies associated with a principal managed by the IAM system, wherein the set of security policies includes a first policy statement and a second policy statement;
• and
• a processor communicatively coupled to the storage device, and configured to:
• identify a first identity set including the principal specified by the first policy statement, wherein members of the first identity set are allowed to access a first system resource set of the IAM system;
• identify a second identity set specified by the second policy statement, wherein the second policy statement specifies that members of the second identity set are denied access to a second system resource set of the IAM system;
• determine whether or not there is a shared system resource belonging to both the first system resource set and the second system resource set, and whether or not the second identity set includes the principal;
• determine that the second policy statement overlaps with the first policy statement for the principal when the shared system resource belongs to the first system resource set and the second system resource set, and the second identity set includes the principal;
• place, when the second policy statement is determined to overlap with the first policy statement, the second policy statement into a list of deny policy statements associated with the first policy statement;
• generate a set of effective access permissions of the first policy statement for the principal using the list of deny policy statements associated with the first policy statement;
• and
• determine an over-privileged access permission for the principal based on the set of effective access permissions without the IAM system receiving a request for accessing the first system resource set or the second system resource set of the IAM system.

A non-transitory computer-readable medium storing instructions, the instructions, when executed by a processor, cause the processor to perform operations by a policy engine for determining effective access permissions defined by security policies associated with a principal managed by an identity and access management (IAM) system, the operations comprising:

• identifying, by a policy engine, a first policy statement associated with the principal, wherein the first policy statement specifies that members of a first identity set including the principal are allowed to access a first system resource set of the IAM system;
• identifying, by the policy engine, a second policy statement, wherein the second policy statement specifies that members of a second identity set are denied access to a second system resource set of the IAM system;
• determining, by the policy engine, whether or not there is a shared system resource belonging to both the first system resource set and the second system resource set, and whether or not the second identity set includes the principal;
• determining, by the policy engine, that the second policy statement overlaps with the first policy statement for the principal when the shared system resource belongs to the first system resource set and the second system resource set, and the second identity set includes the principal;
• placing, by the policy engine, when the second policy statement is determined to overlap with the first policy statement, the second policy statement into a list of deny policy statements associated with the first policy statement;
• generating, by the policy engine, a set of effective access permissions of the first policy statement for the principal using the list of deny policy statements associated with the first policy statement;
• and
• determining an over-privileged access permission for the principal based on the set of effective access permissions without the IAM system receiving a request for accessing the first system resource set or the second system resource set of the IAM system.