Monthly Buzz - October - Insights

0 replies
22 views

How AWS IAM Account Access Manager Works with Identity Security Insights

Workforce access through IAM Identity Center has, until now, been granted with permission sets, the mechanism within IAM Identity Center for provisioning and managing their own IAM roles in each account. That keeps access uniform, but the roles are created for you and are not yours to modify.

Identity Security Insights (Insights) is an identity visibility and intelligence platform. Native connectors ingest identity data from across the estate (including AWS, Microsoft Entra ID, Okta, PingOne, Active Directory and Google Cloud), and the True Privilege™ Graph (which maps what an identity can actually do, not just what's formally assigned) resolves it into the effective privilege each identity holds, along with the escalation pathways behind it.

The pieces on either side of an AWS IAM Account Access Manager assignment were already in that graph: IAM Identity Center users and groups, and IAM roles with their attached policies. Adding the assignments themselves connects the two halves.

From A Role ARN To What It Reaches

An AWS IAM Account Access Manager assignment has three parts: a user or group from IAM Identity Center, the ARN of the IAM role, and the AWS account the role lives in. The permissions live in the role, not the assignment.

Identity Security Insights takes each assignment and extends it both ways, forward to what the role can reach and back to the person and the identity provider behind it. That answers the following three critical questions:

What can the granted role do? You have a role ARN. Insights resolves it into what the role's policies allow, such as the secrets it can read, the parameters it can decrypt and the roles it can assume in turn. The person approving an assignment and the person who wrote the role's policy are often not the same.
Which AWS accounts can the identity reach? AWS IAM Account Access Manager lists a user's or a group's assignments across every account in the organization. Insights adds what each of those roles can do, so every account on that list comes with the access behind it.
Who is behind the assignment, and what can they reach outside AWS? IAM Identity Center is commonly fed from a corporate identity provider. Insights connects with Okta and Microsoft Entra ID, so it can tie an assignment back to the real person behind it and then show what else that person can reach outside AWS.

Continue Reading HERE

Customer Case Study

Karma Automotive Strengthens Support and Saves $600,000 in Labor Costs with BeyondTrust

Latest Available Versions:

Identity Security Insights 26.10 – October, 2026
Identity Security Insights 26.09 - September, 2026

BeeKeepers Hot Topics:

Click here for the most popular articles in our BeeKeepers Community

Upcoming and In Case You Missed It Webinars:

Product Roadmap: Identity Security Insights - September, 2026
Podcast: The Adventures of Alice & Bob

Webinars:

Identity Visibility & Intelligence: The Missing Layer in Modern Identity Security
Securing Machine & AI Agent Identities - November 5, 2026
Battling Identity Security Blind Spots - November 10, 2026
AI Agents Among Us: Identify, Understand, and Control Every AI Agent Action - November 18, 2026
EMEA - AI Agents Among Us: Identify, Understand, and Control Every AI Agent Action - November 19, 2026