Topic starter
25/06/2026 12:44 am
TL;DR: New AWS permissions across IoT, Glue, GuardDuty, Directory Service, Prometheus, Clean Rooms, QuickSight, and EVS can alter encryption, access scope, detections, and workload exposure in ways that materially change cloud trust boundaries, according to Sonrai Security. The governance problem is not just new permissions, but how quickly existing least-privilege models become stale when platform change outpaces review.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Sept Recap: New AWS Privileged Permissions and Regions”.
Key questions
Q: What breaks when AWS adds privileged permissions faster than IAM teams can review them?
A: Least privilege stops reflecting the current platform.
Q: Why do new cloud permissions create risk even when the underlying service is already approved?
A: New permissions can change what an existing service is able to do without changing the service label itself.
Q: How do security teams spot privileged cloud actions that deserve urgent review?
A: Start with permissions that affect access scope, encryption, detection, and network exposure.
Practitioner guidance
- Inventory new cloud actions continuously Track newly released AWS permissions against existing roles and service accounts so that added verbs are visible before they are inherited by production access paths.
- Re-score permissions by security consequence Classify actions that alter encryption, access scope, detection coverage, or internet exposure as high-risk privileges regardless of whether they appear operationally routine.
- Review policy-manipulating privileges first Prioritise permissions that can change GuardDuty entity sets, resource policies, notification routing, or Identity Center configuration because they can hide activity or widen access.
Bottom line: AWS permission growth can change the security meaning of an otherwise familiar role, which makes cloud trust boundaries more fluid than many IAM programmes assume.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:43 am
Cloud privilege governance now depends on service-change monitoring, not just role review: AWS is adding actions that can materially alter security posture after roles have already been designed. That means entitlement governance has to track platform evolution, not merely periodic recertification. For practitioners, the control problem is no longer just who has access, but whether the permission catalogue itself has drifted beyond what governance has assessed.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern AWS privilege changes across fast-moving services?
A: Use action-level entitlement review rather than relying on broad role labels. Each new AWS permission should be evaluated for its effect on data access, detection, and workload exposure, then mapped back to the approval and recertification process. That keeps cloud privilege governance aligned with the live service catalogue.
👉 Read our full editorial: AWS privileged permissions are redefining cloud trust boundaries