Cloud IAM blast radius: map trust before the incident

Cloud incidents are rarely “they found a CVE on the API box.” They are “a CI role could assume a break-glass role that could decrypt the backup vault.” That path was in IAM the whole time. Blast radius work is drawing the graph while you are calm, then deleting the edges that exist only because someone cloned a role in 2019.

Treat AssumeRole as a network

Every trust policy is a route. Human SSO roles, GitHub OIDC, EC2 instance profiles, and Lambda execution roles are nodes. If two nodes can reach each other in three hops and one of them can kms:Decrypt on production, you do not have a “least privilege initiative.” You have a latent incident. Export the graph. Stare at the high-degree nodes.

Cut the surprising edges

• No production decrypt from non-production accounts. Replication roles get a dedicated key and a dedicated policy, not the app key.
• CI should deploy, not operate. If the pipeline can kubectl exec, it can take the data. Split the roles.
• Resource policies on buckets and KMS keys are part of the graph. An identity-based deny does not save you from a bucket that trusts the world of account 1234.
• Log sts:AssumeRole and read it. First-seen assumers are more interesting than volume.

You will not get to zero unused permissions this year. You can get to zero unexplained paths from build to customer data. That is the map worth printing.