AWS privileged permissions: what cloud IAM teams need to watch

TL;DR: AWS June 2025 service updates added new privileged permissions across EC2, AWS Backup, Security Hub, and Bedrock that can alter restore approvals, connector integrity, automation rules, and security boundaries, according to Sonrai Security. The pattern is a widening cloud privilege surface where small permission changes can undermine trust boundaries faster than traditional review cycles can catch them.

NHIMG editorial — based on content published by Sonrai Security: June Recap, New AWS Services and Privileged Permissions

By the numbers:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

Questions worth separating out

Q: How should cloud security teams review newly added AWS permissions?

A: They should review new AWS permissions by the control-plane outcome they can change, not just by service label.

Q: When does a cloud permission become privileged access?

A: A cloud permission becomes privileged when it can change trust, approval, or response behaviour, not merely when it can read or modify a resource.

Q: What do security teams get wrong about least privilege in cloud environments?

A: They often treat least privilege as a static entitlement problem and miss how service updates change the meaning of existing access.

Practitioner guidance

• Review control-plane permissions by operational effect Map new AWS permissions to the security function they can change, such as approval routing, automation rules, connector destinations, or detection disablement.
• Classify workflow-altering actions as privileged Place backup approval changes, Security Hub automation edits, and connector registration updates into the same review path as elevated administrative access.
• Compare AI service access to human-equivalent privilege Do not allow AI-related cloud access to exceed the privilege you would tolerate for a human administrator performing the same task.

What's in the full article

Sonrai Security’s full blog post covers the operational detail this post intentionally leaves for the source:

• Permission-by-permission breakdown of the AWS changes across EC2, Backup, Security Hub, and Bedrock
• The vendor’s explanation of why each permission is considered privileged in the AWS control plane
• Operational examples showing how connector updates, restore approvals, and automation rules can be misused
• A monthly recap format you can reuse for internal cloud privilege review meetings

👉 Read Sonrai Security’s June recap of AWS privileged permission changes →

AWS privileged permissions: what cloud IAM teams need to watch?

Explore further

View Full Forum →  |  NHI Foundation Course →