identity-blast-radius

Assess IAM compromise blast radius by resolving effective permissions across attached and inline policies, then simulating allowed actions to enumerate reachable AWS resources across Data, Identity, Detection, Compute, and Network categories.

IAM blast radius analysis translates effective permissions into a concrete, risk-ranked impact assessment. You need it when a role or user is suspected of compromise or during identity risk assessments following escalation discovery.

Permission boundaries and SCPs constrain IAM risk assessment by applying deny constraints that limit effective actions. The analysis considers these constraints during permission simulation to accurately reflect the true reachable resource scope.

You can simulate transitive privilege escalation paths in AWS using optional PMapper transitive escalation analysis. This identifies potential chained escalation routes beyond the principal's direct effective permissions during the blast radius assessment.

This IAM compromise analysis converts technical access into real-world consequences and produces a structured risk classification ranging from CRITICAL to INFORMATIONAL, accompanied by an auditable worst-case attack narrative.

Evaluating IAM compromise impact requires real AWS IAM permission simulation to accurately count reachable resources. Limitations arise if permission boundaries, SCP constraints, or PMapper transitive escalation analysis are omitted from the assessment scope.