IAM Labyrinth

During a prolonged red team engagement targeting a multinational financial services organization, your team successfully exfiltrated a large internal Git repository containing the company’s AWS IAM policy library.

This repository holds over 80 JSON policy documents reflecting a complex, real-world enterprise environment. The policies include identity-based permissions, resource-based policies, organization-wide Service Control Policies (SCPs), permissions boundaries, cross-account role configurations, KMS key policies, and extensive use of Attribute-Based Access Control (ABAC).

Deep within this policy sprawl exists a single IAM principal that retains access to a highly sensitive production asset despite multiple layers of defensive controls.