Problem
Paste an AWS IAM policy and CloudGuard audits it for wildcard actions, privilege-escalation paths, public exposure, and missing conditions, scoring least-privilege compliance.
AWSIAMCloud SecurityLeast PrivilegePolicy-as-CodeCase study / interactive demo
Case study
From problem to working system
My role
Security engineer and full-stack developer
Solution
Paste an AWS IAM policy and CloudGuard audits it for wildcard actions, privilege-escalation paths, public exposure, and missing conditions, scoring least-privilege compliance.
Architecture
The implementation combines the following technologies and system concerns.
AWSIAMCloud SecurityLeast PrivilegePolicy-as-Code
How it was built
- Parsed arbitrary AWS IAM policy JSON and normalised statements, since IAM accepts both scalars and arrays for nearly every field.
- Detected wildcard actions, wildcard service actions, and wildcard resources, separating the account-wide grant from the service-scoped one.
- Identified privilege-escalation action sets such as PassRole chained with policy version manipulation, which is how least-privilege quietly becomes admin.
- Flagged public principals in resource policies and NotAction-with-Allow, an implicit grant of every future action AWS adds.
Security decisions
- Identified privilege-escalation action sets such as PassRole chained with policy version manipulation, which is how least-privilege quietly becomes admin.
Major challenges
- Parsed arbitrary AWS IAM policy JSON and normalised statements, since IAM accepts both scalars and arrays for nearly every field.
- Detected wildcard actions, wildcard service actions, and wildcard resources, separating the account-wide grant from the service-scoped one.
- Identified privilege-escalation action sets such as PassRole chained with policy version manipulation, which is how least-privilege quietly becomes admin.
Verified evidence
Results and measurable impact
- Identified privilege-escalation action sets such as PassRole chained with policy version manipulation, which is how least-privilege quietly becomes admin.
- Flagged public principals in resource policies and NotAction-with-Allow, an implicit grant of every future action AWS adds.
- Checked for missing Condition constraints on sensitive grants, where MFA, source IP, or tag matching should be required.
- Scored least-privilege compliance with a per-finding weighting and named the specific remediation for each statement.
No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.
Screenshots and access
Product view
Interactive Demo
A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.
cloudguard.zainkhalilkhan.com
CloudGuard
Security platform
Sandbox telemetry
CloudGuardWorkspace2 updates
CloudGuard · IAM Auditor
least-privilege 70/100 · CPaste an AWS IAM policy or pick a sample. CloudGuard parses the JSON and evaluates each statement for wildcard grants, privilege-escalation paths, public exposure, and missing conditions, then scores least-privilege compliance.
70grade C
high1
medium0
low1
Zain Khalil Khan
Client-side sandbox. State is in memory and nothing is sent to a server.