Topic starter
25/06/2026 12:25 am
TL;DR: New AWS permissions across OpenSearch Ingestion, Aurora DSQL, QuickSight, ARC Region Switch, and RTB Fabric can alter logging, escalation, and workflow controls in ways that quietly expand cloud attack paths, according to Sonrai Security’s October 2025 analysis. The lesson is clear: privilege growth is a governance problem, not just a permissions problem.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Oct Recap: New AWS Privileged Permissions and Services”.
Key questions
Q: What breaks when cloud permissions are not scoped tightly around logging and security controls?
A: When permissions are too broad, defenders can lose visibility without realizing it.
Q: Why do new cloud API actions often create more risk than teams expect?
A: Because each new action can expand what an existing role is able to influence, even when the role definition has not changed.
Q: How can security teams tell whether cloud permissions are over-scoped?
A: Look for entitlements that can affect logging, alerting, access policies, or workflow execution rather than just compute or storage operations.
Practitioner guidance
- Build a privileged-action review queue Review every newly introduced AWS API action for its effect on logging, policy inheritance, alert routing, and execution boundaries before it is allowed into production roles.
- Map service roles to control impact Classify cloud entitlements by the control they can change, such as access policy, monitoring, or workflow execution, rather than by the AWS service name alone.
- Rebaseline least-privilege roles after service updates Re-calculate role scopes whenever AWS adds actions to an existing service, because previously acceptable permissions may now grant policy or visibility changes.
Bottom line: New AWS permissions can widen attack paths even when they look like routine service updates.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:19 am
Cloud privilege sprawl is now a control-plane problem, not a permissions spreadsheet problem: the important question is no longer whether a permission sounds administrative, but whether it can change observability, policy inheritance, or execution paths. In AWS, small API additions can widen the blast radius of otherwise familiar roles. Practitioners should treat every new action as a governance event, not a catalogue update.
A few things that frame the scale:
- 49% of IT professionals would prioritise improving privileged access management if the decision were theirs alone, according to Netwrix's 2023 Hybrid Security Trends Report.
A question worth separating out:
Q: Should organisations review AWS permissions only when incidents occur?
A: No. They should review newly added actions whenever AWS expands a service, because the risk emerges before an incident does. Waiting for an event means the organisation is always behind the platform's capability curve. Continuous entitlement review is the only defensible way to keep least privilege aligned with cloud change.
👉 Read our full editorial: AWS privilege expansion is quietly widening cloud attack paths