Cloud IAM Risk Calculator

Risk = capped points for administrator ratio (×2.5), wildcard policy ratio (×0.25), stale principal ratio (×0.2), stale key ratio (×0.6), missing MFA (×0.15) and unconditioned cross-account trust (×1.5 per role), summed and clamped to 0–100. Each dimension is converted to a ratio, scaled and capped so no single input can consume the whole score, then the capped points are added. The caps are deliberately uneven: the administrator ratio can take 25 points because standing administrator access is the single largest determinant of blast radius, while stale principals can only take 15.

Almost every cloud breach starts with a credential, and the difference between one compromised key and a full account takeover is the privilege attached to that key plus whether anyone would have noticed it was idle for a year.

This calculator takes 8 inputs: Total IAM principals (users plus roles), Principals with administrative privilege, Customer-managed policies, Policies containing Action:* or Resource:*, Principals with no activity for 90 days, Access keys older than 90 days, MFA coverage across human identities, Cross-account trust roles with no ExternalId condition. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Anything that can grant itself more privilege: AdministratorAccess, iam:* on all resources, iam:PassRole with a wildcard, or the ability to update its own trust policy. Count roles as well as users — an EC2 instance profile with iam:* is an administrator that never logs in.

A cross-account role without an ExternalId condition can be assumed by any principal in the trusted account, including one an attacker creates. It turns your blast radius into somebody else's IAM hygiene, which is why each such role costs 1.5 points.