Cloud infrastructure excessive resource permission detection based on semantic grouping

A computing system comprising:

• at least one processor;
• and
• memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
• parse a collection of granular privileges to generate a plurality of privilege groups, each respective privilege group, of the plurality of privilege groups, grouping two or more granular privileges, in the collection of granular privileges, having a threshold similarity to a target action represented by the respective privilege group;
• identify, based on policy data, a set of privilege grant times, each privilege grant time representing a time at which a corresponding granular privilege, in the collection of granular privileges, was granted to a subject identity, the corresponding granular privilege defining access permissions for the subject identity to a subject resource in a computing environment;
• map the set of privilege grant times to the plurality of privilege groups;
• and
• generate an infrastructure graph based on the mapping, the infrastructure graph comprising:
• identity nodes that represent the subject identities,
• resource nodes that represent the subject resources, and
• edges that represent the set of privilege grant times mapped to the plurality of privilege groups.

A computer-readable media having computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by a computer, cause the computer to:

• parse a collection of granular privileges to generate a plurality of privilege groups, each respective privilege group, of the plurality of privilege groups, grouping two or more granular privileges, in the collection of granular privileges, having a threshold similarity to a target action represented by the respective privilege group;
• identify, based on policy data, a set of privilege grant times, each privilege grant time representing a time at which a corresponding granular privilege, in the collection of granular privileges, was granted to a subject identity, the corresponding granular privilege defining access permissions for the subject identity to a subject resource in a computing environment;
• map the set of privilege grant times to the plurality of privilege groups;
• and
• generate an infrastructure graph based on the mapping, the infrastructure graph comprising:
• identity nodes that represent the subject identities,
• resource nodes that represent the subject resources, and
• edges that represent the set of privilege grant times mapped to the plurality of privilege groups.