Skip to content
ENExplore Calculators

Cloud IAM Risk Calculator

Score cloud IAM risk from administrator ratio, wildcard policies, stale principals, ageing access keys, MFA coverage and cross-account trust.

About Cloud IAM Risk Calculator

Each dimension is converted to a ratio, scaled and capped so no single input can consume the whole score, then the capped points are added. The caps are deliberately uneven: the administrator ratio can take 25 points because standing administrator access is the single largest determinant of blast radius, while stale principals can only take 15. Almost every cloud breach starts with a credential, and the difference between one compromised key and a full account takeover is the privilege attached to that key plus whether anyone would have noticed it was idle for a year.

Formulas

Cloud IAM Risk

Risk = capped points for administrator ratio (×2.5), wildcard policy ratio (×0.25), stale principal ratio (×0.2), stale key ratio (×0.6), missing MFA (×0.15) and unconditioned cross-account trust (×1.5 per role), summed and clamped to 0–100.

adminRatio
Administrative principals ÷ all principals × 100
wildcardRatio
Policies with Action:* or Resource:* ÷ all managed policies × 100
trustPts
1.5 points per cross-account role missing an ExternalId, capped at 15

Blast radius

Privileged blast radius = administrative principals + cross-account trust roles — the count of identities whose compromise reaches the whole account.

adminPrincipals
Principals with AdministratorAccess or an equivalent policy
crossAccountRoles
Roles trusted by a principal in another account

Worked example

With the default values below, Cloud IAM Risk Calculator returns IAM Risk Score of 35.4. Change any input above and every figure here is recalculated in your browser.

Inputs used

Total IAM principals (users plus roles)accepts 1–500,000 principals
850 principals
Principals with administrative privilegeaccepts 0–100,000 principals
24 principals
Customer-managed policiesaccepts 1–100,000 policies
310 policies
Policies containing Action:* or Resource:*accepts 0–100,000 policies
42 policies
Principals with no activity for 90 daysaccepts 0–500,000 principals
210 principals
Access keys older than 90 daysaccepts 0–100,000 keys
46 keys
MFA coverage across human identitiesaccepts 0–100 %
78 %
Cross-account trust roles with no ExternalId conditionaccepts 0–20,000 roles
9 roles

Results

IAM Risk Score
35.4 / 100
Risk Level
Low
Administrative Principal Ratio
2.82%
Wildcard Policy Ratio
13.5%
Stale Principal Ratio
24.7%
Privileged Blast Radius
33 principals
Least-Privilege Headroom
64.6 points
Highest-Value Fix
Add an ExternalId condition to every cross-account trust policy

Step by step

  1. 1Values used
  2. 2Cloud IAM Risk
  3. 3Blast radius
  4. 4IAM Risk Score= 35.4 / 100
  5. 5Risk Level= Low
  6. 6Administrative Principal Ratio= 2.82
  7. 7Wildcard Policy Ratio= 13.5
  8. 8Stale Principal Ratio= 24.7
  9. 9Privileged Blast Radius= 33 principals

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Cloud IAM Risk calculated?

Risk = capped points for administrator ratio (×2.5), wildcard policy ratio (×0.25), stale principal ratio (×0.2), stale key ratio (×0.6), missing MFA (×0.15) and unconditioned cross-account trust (×1.5 per role), summed and clamped to 0–100. Each dimension is converted to a ratio, scaled and capped so no single input can consume the whole score, then the capped points are added. The caps are deliberately uneven: the administrator ratio can take 25 points because standing administrator access is the single largest determinant of blast radius, while stale principals can only take 15.

Why does Cloud IAM Risk matter?

Almost every cloud breach starts with a credential, and the difference between one compromised key and a full account takeover is the privilege attached to that key plus whether anyone would have noticed it was idle for a year.

What values do I need to enter?

This calculator takes 8 inputs: Total IAM principals (users plus roles), Principals with administrative privilege, Customer-managed policies, Policies containing Action:* or Resource:*, Principals with no activity for 90 days, Access keys older than 90 days, MFA coverage across human identities, Cross-account trust roles with no ExternalId condition. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

What counts as an administrative principal?

Anything that can grant itself more privilege: AdministratorAccess, iam:* on all resources, iam:PassRole with a wildcard, or the ability to update its own trust policy. Count roles as well as users — an EC2 instance profile with iam:* is an administrator that never logs in.

Why penalise cross-account roles so heavily?

A cross-account role without an ExternalId condition can be assumed by any principal in the trusted account, including one an attacker creates. It turns your blast radius into somebody else's IAM hygiene, which is why each such role costs 1.5 points.

Related Calculators

Cloud IAM Risk Calculator | Calcrivo