Abstract

Cloud Identity and Access Management (IAM) is foundational to cloud security. Maintaining the principle of least privilege (PoLP) in complex cloud environments remains a significant challenge for modern enterprises.Tools like AWS IAM Access Analyzer are genuinely good at what they do: catching public access, unused permissions, anything a policy technically allows that it probably shouldn't. But "technically allowed" and "actually intended" are not the same question, and no amount of formal verification can answer the second one on its own. A permission can pass every reachability check a system throws at it and still contradict what the business actually approved — a role quietly retains decrypt access to a PII key long after the project that justified it has shipped, and nothing in the policy syntax says otherwise. This paper calls that gap "Semantic Drift," and proposes an agentic Retrieval-Augmented Generation (RAG) framework built to close it. Rather than reading policies in isolation, the system pulls together CloudTrail logs, resource-based policies, live IAM state, and Access Analyzer findings, then sets them against the organization's own paper trail — Business Requirement Documents, Technical Requirement Documents, and Architectural Design Records — to see where the two disagree. It does this through three stages: isolating the right context for a given principal, decomposing the technical policy into a chain-of-thought capability map, and reconciling that map against documented intent to surface violations a syntax-only scanner would wave straight through. The work should be of particular interest to cloud security architects, IAM practitioners, GRC teams, and researchers working at the intersection of generative AI and identity governance.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Download

Share

COinS