Topic starter
25/06/2026 12:55 am
TL;DR: AWS added privileged permissions across Clean Rooms, SES, Bedrock, Batch, WorkSpaces, and SSO that can redirect data access, weaken monitoring, extend sessions, or run arbitrary workloads, according to Sonrai Security. The finding shows how cloud privilege growth turns least privilege into a moving target for IAM and PAM teams.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “August Recap: New AWS Privileged Permissions”.
Key questions
Q: What breaks when AWS adds privileged permissions faster than IAM teams can review them?
A: Least privilege stops reflecting the current platform.
Q: Why do newly added cloud permissions often create hidden privilege risk in mature environments?
A: New permissions often bypass existing review habits because teams focus on services, not the actions hidden inside them.
Q: What are the signs that cloud resource governance is failing?
A: Common signs include unexpected cost spikes, resources being enlarged without review, new assets appearing outside approved procedures, and engineers not knowing the financial impact of what they deploy.
Practitioner guidance
- Review newly published cloud actions weekly Compare each new AWS service action against your privileged access catalog and flag any permission that can alter data scope, monitoring, sessions, or execution.
- Classify session and logging permissions as privileged Treat telemetry rule changes, session logger changes, and certificate-based trust changes as PAM-relevant entitlements rather than ordinary admin operations.
- Map durable side effects for each permission Document whether a permission can persist access, redirect data, weaken observability, or create workload execution rights after the call completes.
Bottom line: AWS permission growth can turn ordinary service actions into privileged access paths that change data, monitoring, and execution boundaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:01 am
Cloud privilege drift is now a governance problem, not a release-note problem. AWS keeps adding actions that alter data access, logging, trust duration, and workload execution, and those changes can silently reclassify ordinary permissions into privileged ones. IAM and PAM programmes that only review roles at creation time will miss the real risk window, because the entitlement meaning changes after deployment. The practitioner conclusion is simple: permission review must track platform change velocity, not just role assignment.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams respond when cloud services expand privileged permissions?
A: They should reclassify the new actions, update access reviews, and decide whether those permissions belong in standard roles at all. If a permission can change data scope, trust duration, or observability, it should be treated as privileged from day one. The question is not whether it is convenient, but whether it is governable.
👉 Read our full editorial: AWS privileged permissions are expanding the cloud attack surface