Real-Time AWS IAM & Access Denied Intelligence Engine
In modern cloud environments, AccessDenied and Client.UnauthorizedOperation errors are not just troubleshooting nuisances—they are prime early-warning signals. Spikes in permission failures often indicate active credential compromise, lateral movement reconnaissance, compromised compute instances, or broken CI/CD deployments.
RoleTrail bridges the gap between IAM policy management and threat detection by providing actionable visibility into both successful calls and failure storms across entire AWS Organizations:
Instantly correlates failure storms by account_id + role_arn + iam_action. Detects when assumed-role sessions attempt privilege escalation or scan restricted APIs before damage occurs.
Classifies every permission as Used (proven successful calls in window), Unused (allowed but never executed), or Unknown (actions outside management CloudTrail like PassRole).
Failed API attempts are counted and analyzed separately. Failed calls never falsely mark a permission as "used," preventing attacker probing from corrupting your least privilege baseline.
Existing IAM and CloudTrail tools either lack action-level call counts, ignore failure context, rely on service-only approximations, or charge prohibitive per-entity fees:
| Tool | Granularity | Call Counts | Failures & Access Denied | Data Source |
|---|---|---|---|---|
| Netflix Aardvark + Repokid | Service last-accessed | No | No | IAM Access Advisor (mutates inline policies) |
| IAM Access Analyzer Unused Access | Service + select actions | No | No | IAM last-accessed (billed per entity) |
| Access Analyzer Policy Gen | Actions seen in CloudTrail | No | No | CloudTrail (max 90-day window) |
| Duo-Labs CloudTracker | Action present / absent | No | Limited | Athena over CloudTrail |
| RoleTrail (Self-Defending) | Action counts per role | Yes (Daily Facts) | Yes (AccessDenied & UnauthorizedOp) | Org CloudTrail in S3 + CloudWatch Logs Stream |
RoleTrail is engineered following strict AWS multi-account security best practices, cleanly isolating storage, analytics, and member workloads:
(role, iam_action, outcome, day) → count, ingests real-time CloudWatch streams, and serves the UI dashboard.eventID.Accurately resolves identities from userIdentity.sessionContext.sessionIssuer, properly attributing API calls to human engineers, CI/CD runners, and assumed roles while filtering out noisy AWS service events.
Toggle seamlessly between 30, 60, 90, and 365-day observation windows to distinguish between high-frequency daily operations and legitimate annual disaster recovery or audit workflows.
Includes complete modular Terraform configurations for the Logging account bucket policy, Security account warehouse (Athena, Glue, Firehose), and Member account subscription filters via StackSets.
Groups new AccessDenied exceptions by account_id + role_arn to emit bounded EventBridge/SNS alerts without overwhelming responders with duplicate notification floods.
Built with Next.js and TypeScript, providing searchable role matrices, visual unused-action diffs, failure breakdown charts, and direct JSON export for automated policy synthesis.
Avoids the massive cost and 3-dimension limits of CloudWatch metric filters by using high-throughput subscription filters and cost-effective Athena partition projection queries.
Explore RoleTrail on GitHub Back to Open Source Tools Back to Home