Cloud permissions drift between reviews: a clean audit in January says little about the keys, roles and trusts that exist in June. This health check turns cloud identity hygiene into 11 measured indicators that you track every month and sign off every quarter, so drift shows up as a trend line rather than as a surprise in an incident. It complements the one-off Cloud IAM Review Checklist, which tells you how to run a full review and what each control should look like; this page assumes those controls exist and asks whether they are holding.
It is written for cloud security teams, identity architects and internal audit across any public cloud platform or combination of platforms. The metrics cover human and non-human identities alike, because in most cloud estates roles, service accounts and access keys outnumber people many times over. For the design of the controls themselves, see the Cloud PAM and CIEM Guide.
What this health check covers
Scope is every cloud account, subscription and project in the organisation, plus the identity provider that federates people into them. It measures the identity control plane: root and emergency accounts, people, workload identities, long-lived credentials, policies, cross-account and external trust, and the gap between granted and used permissions. It does not measure workload configuration, network exposure or data stores; those belong to posture management and the Cloud Security Posture Management (CSPM) Guide.
- Who runs it: the cloud security or cloud platform team collects the data; the identity team owns federation metrics; internal audit samples the evidence.
- How it differs from the review checklist: the checklist is a point-in-time pass or fail against each control. The health check is a repeatable set of ratios with thresholds, read as a trend over at least three periods.
- What it catches: keys that quietly age past policy, wildcard policies that creep back in after a clean-up, new third-party trusts nobody reviewed, people who bypass single sign-on with local console users, and roles that keep permissions they never use.
Key takeaways
- Measure ratios, not counts. "37 old keys" means nothing without the denominator; a share of all keys shows whether the estate is getting better as it grows.
- Non-human identities drive most metrics. Access keys, workload roles and cross-account trusts change far more often than human admin rights, so give them weekly or monthly collection.
- The permission utilisation gap is the drift indicator. It shows how much granted access goes unused across the usage window, and it rises long before an incident makes it visible.
- Any root or emergency account use without a ticket is red. No trend analysis is needed for that metric; investigate each event.
- Thresholds are starting points. Tighten them each year as automation, federation and just-in-time access mature.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this Cloud Identity Health Check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Root and emergency account use (CI-01) | Continuous alert, weekly check | Cloud security operations | Head of cloud security | Alert record, matching change or incident ticket |
| Credential metrics (CI-02, CI-03, CI-07) | Monthly | Cloud platform team | Cloud security lead | Dated credential and key inventory export |
| Policy and permission metrics (CI-04, CI-05, CI-10) | Monthly | Cloud security team | Cloud security lead | Policy export, unused access findings with run date |
| Trust and privilege metrics (CI-06, CI-08, CI-09, CI-11) | Quarterly | Cloud security team with identity team | CISO or delegate | Trust relationship list, admin role holder list, sponsor confirmations |
| Full health check report and trend | Quarterly | Cloud security lead | CISO; risk committee for red metrics | Metric table for three periods, findings log, signed approval |
| Independent sample | Annually | Internal audit | Audit committee | Re-performed calculation for at least three metrics |
Metrics
All metrics are calculated per platform and for the estate as a whole. Use a 90-day usage window unless stated. NHI Mgmt Group recommended thresholds; adjust to your risk appetite.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| CI-01 | Root account use | Root or emergency account sign-ins and API calls without a linked ticket in the period (count, no denominator) | Cloud control-plane audit logs, alert history | 0 | Not used (any unticketed use is red) | 1 or more |
| CI-02 | Long-lived access key share | Active workloads authenticating with a static access key or service account key / all active workload identities | Credential report, key inventory, workload identity list | Under 10% | 10 to 25% | Over 25% |
| CI-03 | Key age over 90 days | Active static keys older than 90 days / all active static keys | Credential report with key creation dates | Under 5% | 5 to 15% | Over 15% |
| CI-04 | Unused role rate | Roles, service accounts and users with no authentication in 90 days / all roles, service accounts and users | Last-used data, unused access findings | Under 5% | 5 to 15% | Over 15% |
| CI-05 | Wildcard policy share | Custom policies or role definitions granting all actions, all resources, or a whole service with write rights, outside approved admin roles / all custom policies | Policy and role definition export | Under 2% | 2 to 5% | Over 5% |
| CI-06 | Cross-account trusts unreviewed | Cross-account, cross-tenant and workload federation trusts without a sponsor confirmation in the last 12 months / all such trusts | Trust policy export, external access findings, sponsor register | 0% | Above 0% to 10% | Over 10% |
| CI-07 | Workload federation share | Workloads outside the cloud (CI pipelines, other clouds, on-premises) using federated short-lived tokens / all workloads outside the cloud that call cloud APIs | Federation provider config, CI job identity settings, key inventory | Over 80% | 50 to 80% | Under 50% |
| CI-08 | Human console users without SSO | People with local cloud console passwords or local users / all people with console access | Credential report, identity provider assignment list | Only documented emergency accounts | Above 0% to 2% beyond them | Over 2% beyond them |
| CI-09 | Admin role holders | Identities with standing administrator or access-granting roles / all identities with any role; track human and non-human separately | Role assignment export including inherited assignments, just-in-time eligibility list | Under 2% and all humans just-in-time | 2 to 5% or some standing human admins | Over 5% or growing three periods running |
| CI-10 | Permission utilisation gap | Granted permissions (actions or services) not used in 90 days / all granted permissions, averaged across roles | Unused permission findings, last-accessed data, role recommendation output | Under 30% | 30 to 60% | Over 60% |
| CI-11 | External principal grants | Grants to principals outside the organisation (guests, foreign accounts, public or anonymous access) without a sponsor and end date / all external principal grants | External access findings, guest user list, resource policy export | 0% | Above 0% to 5% | Over 5% |
Reading the metrics together
- CI-02 and CI-07 move together: as workload federation rises, the long-lived key share should fall. If federation rises and key share does not, old keys were left active after migration. See the Workload Identity Federation Guide.
- CI-04 and CI-10 are different signals: unused roles are identities to delete; the utilisation gap is excess permission on identities that are in use and need right-sizing.
- CI-09 needs a growth check: a stable share hides absolute growth in a fast-growing estate, so report the count alongside the ratio.
- CI-06 and CI-11 cover different doors: trusts let another account assume a role; grants put an outside principal straight onto a resource or role.
How to collect the data
Pull every figure from the platform itself, not from documentation or a configuration management record, and store each export with its collection time. The same export sources serve every period, which is what makes the trend credible.
- Credential inventory: the cloud platform's credential report or key listing per account, with key creation date, last used date and owning identity. This feeds CI-02, CI-03 and CI-08.
- Identity and role inventory: a full export of users, roles, service accounts and managed identities with last authentication time, from the cloud identity service across all accounts in the organisation. This feeds CI-04 and the denominators of CI-02 and CI-09.
- Policy and role definitions: every custom policy and role definition at organisation, account and resource scope. Parse them for wildcard actions and resources rather than relying on names; this feeds CI-05.
- Unused access and permission analysis: the platform's native unused access analyser or role recommender output, or your own analysis of control-plane audit logs over the 90-day window. Record whether the analyser covers the full window, because some native tools look back less far than others. This feeds CI-04 and CI-10.
- Trust and external access: role trust policies, cross-tenant settings, workload federation configuration and external access findings, matched against a sponsor register held by the cloud security team. This feeds CI-06 and CI-11.
- Identity provider records: application assignments and group membership for the cloud federation connection, and sign-in logs, to show who reaches the console through single sign-on. This feeds CI-08 and the human part of CI-09.
- Control-plane audit logs: organisation-wide, retained centrally, filtered for root and emergency account events. Match each event to a change or incident ticket for CI-01.
Automate collection on a schedule using a dedicated read-only audit identity per platform. That identity is itself privileged reach into every account: give it read-only rights, federated credentials and its own entry in the trust register.
Red flags that need action now
- Any root or emergency account sign-in or API call with no matching ticket.
- A static key over 365 days old on an identity with write or administrator rights.
- A new policy granting all actions on all resources outside the approved admin role set since the last period.
- A cross-account trust to an account that no current supplier or business unit owns.
- Public or anonymous access granted through a resource policy on a store or key that holds sensitive data.
- A people account with console access and no single sign-on, created after the last review.
- A workload federation trust whose subject condition accepts any repository, branch or audience. See the Workload Identity Federation Trust Review Checklist.
- The admin role holder count up by more than 20% in one quarter without a matching change programme.
- Collection failed for any account, so the metric covers less than the full estate.
Findings log
Record one row per finding. Use the metric ID so the finding can be traced back to the trend; close a finding only when the next collection shows the metric has moved.
| Finding ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-CLOUDID-01 | [Example: 14 static keys over 90 days on CI pipeline identities in production accounts] | CI-03 | [High] | [Platform engineering lead] | [DD/MM/YYYY] | [Open] |
| HC-CLOUDID-02 | [Example: 3 supplier trusts with no sponsor confirmation] | CI-06 | [Medium] | [Vendor management] | [DD/MM/YYYY] | [Open] |
| HC-CLOUDID-03 | [Finding] | [CI-xx] | [Critical, High, Medium, Low] | [Named owner] | [DD/MM/YYYY] | [Open, In progress, Closed, Risk accepted] |
Suggested service levels: critical within 7 days, high within 30 days, medium within 90 days. A risk acceptance needs an expiry date and the approver from the cadence table.
Remediation map
| Finding type | Metrics | Where the fix is described |
|---|---|---|
| Root or emergency account misuse or weak controls | CI-01 | Break-Glass Account Guide; Protecting Cloud Control-Plane Recovery Accounts and Credentials |
| Old or unnecessary static keys | CI-02, CI-03 | Secrets Rotation Runbook Template; Cloud Access Key Leak Playbook if exposure is suspected |
| Workloads outside the cloud still on keys | CI-07 | Workload Identity Federation Guide; Cloud Workload Identity Guide |
| Unused identities and excess permissions | CI-04, CI-10 | Least Privilege Techniques Guide; Cloud PAM and CIEM Guide |
| Wildcard and admin-equivalent policies, standing admins | CI-05, CI-09 | Cloud IAM Review Checklist, sections 6 to 9; Privileged Access Management Guide |
| Unreviewed trusts and external grants | CI-06, CI-11 | Workload Identity Federation Trust Review Checklist; Access Reviews Guide |
| People bypassing single sign-on | CI-08 | Cloud IAM Review Checklist, human access checks |
Related guides
- Cloud IAM Review Checklist: the full one-off review procedure this health check tracks between runs.
- Cloud Identity and CIEM Maturity Model: where these metrics place you, and what the next level needs.
- Security Metrics and KPIs Programme Guide: how to report metrics like these to leadership.
- Cloud Credential Compromise Playbook: what to do when a red flag turns out to be an incident.
- ISPM Guide: tooling that can automate much of the collection.
References
- NIST: SP 800-53 Rev. 5 (AC-2 Account Management, AC-2(3) Disable Accounts, AC-6 Least Privilege, AC-6(5) Privileged Accounts, AC-6(7) Review of User Privileges, IA-5 Authenticator Management, AU-6 Audit Record Review, Analysis, and Reporting)
- NIST: Cybersecurity Framework 2.0 (PR.AA-01, PR.AA-05, GV.OV-03)
- CIS: Critical Security Control 5, Account Management
- CIS: Critical Security Control 6, Access Control Management
- CISA: Cloud Security Technical Reference Architecture
Related NHI Mgmt Group resources: Cloud IAM Review Checklist · Cloud PAM and CIEM Guide · Cloud Identity and CIEM Maturity Model · Workload Identity Federation Guide