iam-audit

/iam-audit

Audit access controls across applications and infrastructure.

Trigger

Use when you need to:

• Review who has access to what in a system
• Identify over-privileged accounts and privilege creep
• Prepare for a SOC 2, PCI DSS, or ISO 27001 audit (access control section)
• Evaluate access controls after organizational changes
• Investigate whether former employees still have access

Input

One or more of:

• Access control configuration: RBAC role definitions, IAM policies, ACLs, group memberships
• User/identity list: Current identities with their assigned roles and permissions
• Access logs: Authentication logs, authorization decision logs, API access logs
• Organizational data: Org chart, team structure, role definitions (for comparison to actual access)
• Specific scope: System, application, or identity subset to audit

Process

Phase 1: Identity Inventory

1. Identity enumeration

   • Count and categorize identities: human users, service accounts, API keys, external/guest users
   • Identify identity sources: internal directory, SSO, local accounts, federated
   • Last activity timestamp for each identity
   • Dormant accounts (no activity in 90+ days)
   • Orphaned accounts (no owner, former employees)

2. Authentication assessment

   • MFA enrollment status for all human users
   • MFA enforcement (required vs optional)
   • Password policy compliance
   • Service account authentication method (keys, certificates, managed identity)

Phase 2: Permission Analysis

1. Role/permission inventory

   • All defined roles and their permissions
   • Number of users per role
   • Roles with no users (dormant roles)
   • Roles with excessive permissions (admin-equivalent)
   • Custom vs predefined roles

2. Permission usage analysis (if access logs available)

   • Granted permissions vs actually used permissions per identity
   • Identities using less than 20% of granted permissions (over-privileged)
   • Permissions never used by any identity (candidate for removal)