Topic starter
02/06/2026 8:49 pm
TL;DR: Unused roles, keys, passwords and permissions in AWS still need human action after Sonrai Security reports they are surfaced by IAM Access Analyzer. Access governance stays stuck until revocation becomes safe, reversible and scalable.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Why IAM Access Analyzer Tells You About Unused Permissions But Won't Remove Them”.
Key questions
Q: Why do unused permissions remain a risk even after teams find them?
A: Because a finding is not a fix.
Q: What do security teams get wrong about unused access cleanup?
A: They often assume a finding backlog can be cleared role by role without breaking production.
Q: What fails when unused AWS permissions are only detected and not enforced?
A: The control fails at remediation.
Practitioner guidance
- Define an unused-access enforcement path Map which dormant AWS permissions can be blocked centrally, which must remain available, and which require explicit restore approval before they can be re-enabled.
- Separate detection from remediation ownership Assign one team to surface unused access and another to approve and execute revocation so findings do not remain stranded in the review queue.
- Preserve identity structure while revoking privilege Prefer org-level blocking for unused privileged permissions so the role stays intact and restoration does not require re-engineering the identity.
Bottom line: Unused AWS access is a governance problem when teams can see dormant permissions but cannot remove them safely at scale.
Glossary terms: Unused Access, Least Privilege, Remediation Backlog, Org-Level Blocking
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 18 hours ago by NHI Mgmt Group
02/06/2026 8:52 pm
Visibility without enforcement is not least privilege: The central lesson here is that discovery tools do not reduce risk unless they are connected to a safe revocation path. Access Analyzer can identify dormant permissions, but the governance burden stays with the team that must decide what to remove and what to preserve. That makes enforcement capacity the real control variable, not the number of findings surfaced.
A few things that frame the scale:
- 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
A question worth separating out:
Q: What is the difference between access visibility and access enforcement?
A: Access visibility tells you what users can do, while access enforcement changes that state in the target systems. A graph can expose effective permissions without being able to remove them, and a governance workflow can revoke access without showing the full entitlement picture. Practitioners need both layers, but they solve different problems.
👉 Read our full editorial: IAM Access Analyzer finds unused access, but enforcement stays manual