Cloud IAM Governance & Least-Privilege Program
Designed and implemented a least-privilege IAM governance framework across 18 AWS accounts, eliminating 340+ individual IAM users, all standing privileged access, and the top ITGC audit risk finding, within 12 months.
A technology company formed through merger inherited two separate AWS environments with divergent IAM architectures and no unified governance model. The combined estate contained over 340 individual IAM users across 18 accounts, numerous long-lived access keys with no rotation policy, pervasively overprivileged roles granting far broader access than any business function required, and no access certification or review process. Multiple accounts retained active root access keys without MFA enforcement. The ITGC audit had identified IAM governance as the single highest-risk finding across the entire estate, with both the audit committee and external auditors requesting a formal remediation plan within 90 days. Root account access keys were active on several accounts with no MFA enforced, the highest-risk IAM configuration possible. There was no access review or certification process; entitlements had never been formally reviewed post-onboarding. No PAM solution was in place, so all administrative access was standing, unmonitored, and ungoverned.
I began with a comprehensive IAM entitlement review across all 18 AWS accounts using AWS IAM Access Analyzer and custom Python scripts to identify dormant users, excessive permissions, unused roles, long-lived access keys, and policy violations, producing a complete risk-graded entitlement inventory as the remediation baseline, and mapped every finding to NIST SP 800-53 access control requirements and the CIS AWS Foundations Benchmark. I designed a role-based access control model aligned to job functions, enforcing least-privilege through AWS Permission Boundaries and Service Control Policies applied at the AWS Organizations level, then implemented AWS IAM Identity Center as the centralized identity broker integrated with Azure AD as the corporate identity provider, replacing all 340+ individual IAM users with federated identities managed through the existing HR-driven joiner-mover-leaver process. I deployed CyberArk Privileged Access Management to enforce just-in-time access for every administrative role, eliminating all standing privileges across all 18 accounts and requiring time-bounded, session-recorded access for every administrative action, and removed all root access keys while enforcing MFA on root accounts, with detective controls via AWS Config and GuardDuty to alert on any root account activity. I built automated access key rotation enforcement through AWS Config Rules with Lambda auto-remediation, disabling keys that exceeded 90 days without rotation and notifying key owners without manual intervention, and established quarterly access review campaigns using SailPoint IIQ integrated with AWS IAM, routing entitlement decisions to role owners and escalating non-responses to managers after five business days. Finally, I documented all IAM policies, RBAC matrices, access review procedures, and PAM governance in a formal IAM Governance Playbook reviewed and approved by the CISO and Legal, giving the program an auditable, durable governance foundation.