security-audit
First Principles for an AWS IAM Audit Agent
How to think about an IAM audit automation project before writing scanners or reports.
An IAM audit agent should not begin as a script that dumps every permission. It should begin with a small set of questions that map to clear operational risk.
Start with questions
- Which human users can still access the account?
- Which users are missing MFA?
- Which access keys are old, unused, or never rotated?
- Which principals have broad administrator access?
- Which findings require action now, and which only need tracking?
Keep outputs reviewable
The first useful version should produce a table that a reviewer can understand without reading the source code. A minimal output can include:
Principal | Finding | Severity | Evidence | Recommended action
That format keeps the tool aligned with the audit conversation instead of turning it into a raw data export.
Automate explanation, not only detection
Detection tells you something is wrong. Explanation helps another team accept the finding and fix it. For audit automation, the report language is part of the product.