Security & Compliance · AWS IAM drift detection

IAMWatch

Access, exactly as approved.

Compare today's AWS IAM with the baseline you approved and see every risky change, from quiet admin grants to forgotten vendor roles.

AWS companies facing ISO 27001 or SOC 2MSPs managing many client accountsTeams without a cloud security engineer

Book an IAMWatch demo See pricing

iam-drift · example

$ iam-drift baseline.json current.json
iam-drift: 6 critical, 3 high, 3 medium, 1 low, 2 info
‼ CRITICAL [IAM005] role:app-role: Can now iam:passrole on *
‼ CRITICAL [IAM006] role:vendor-audit: Trust policy: arn:aws:iam::999988887777:root can now assume this role
‼ CRITICAL [IAM002] user:deploy-bot: Policy attached: AdministratorAccess
‼ CRITICAL [IAM003] user:priya: Added to group admins
! HIGH     [IAM005] role:app-role: Can now secretsmanager:getsecretvalue on *

Real run on the sample snapshots included with the product. It reports what policies allow, not what anyone did; use CloudTrail for that.

ReadsAWS IAM

ComparesAgainst your baseline

AccessRead-only

FlagsRisky access changes

The problem

"Temporary" admin access never gets removed, contractor roles pile up and nobody remembers adding the vendor's trust relationship. Auditors ask how you'd know.

What it does

Diffs two IAM snapshots from aws iam get-account-authorization-details

Admin policies attached and users added to admin groups

Privilege-escalation permissions such as iam:PassRole on *

Secrets, KMS and data reads, and audit-log tampering

Roles a new outside account can assume, critical with no ExternalId

Removed permission boundaries and changed policy versions

No AWS credentials of its own: it reads the exports you make

How it works

Export a snapshot after review and keep it as the baseline
Export again daily or weekly and run the diff
Review each change, then approve the new baseline

Works with

AWS IAMAWS Organizations

Runs in your CI

GitHub Actions workflow step

- run: aws iam get-account-authorization-details > current.json
- run: iam-drift baseline.json current.json --format markdown --out drift.md --fail-on high

Licensed customers get the action or command-line tool installed in their own organisation; it runs on your runners, so your code and plans never leave them. The command-line tools run in GitLab CI the same way.

Your data

Read-only IAM access.
Baselines live in your repository.
No changes are made.

Who it's for

AWS companies facing ISO 27001 or SOC 2MSPs managing many client accountsTeams without a cloud security engineer

Questions

What is a baseline?

A snapshot of approved access; every later change is compared with it.

Can it run daily?

Yes, as a scheduled job that reports only what changed.

Often used with IAMWatch

Security & Compliance

MaskWall

AI data firewall

Use AI. Keep your secrets. A protective layer between your company and every AI service. Keys, passwords and customer data are blocked or masked before they leave, and quietly restored in the reply.

$199–499/month (₹8,000–25,000 in India)View product → Security & Compliance

PrivacyPilot

DPDP privacy compliance

Privacy compliance, made practical. Find the gaps between your website and India's DPDP Act, and get the privacy notice, data inventory and consent banner to close them. Notices are checked against GDPR, UK, US and Australian rules too.

₹2,999 per siteView product → Security & Compliance

CERT-In Ready

CERT-In compliance check

CERT-In, checked properly. Check your infrastructure against the CERT-In Directions as written: 180 days of logs held in India, synchronised time and incident reporting.

₹25,000–75,000View product →

← PreviousTestHealer Next →IncidentLens

See IAMWatch on your own data

A 30-minute call. We run the product on your export, repository or document and walk you through the results.

Book a demo