Cloud Identity Policy Reachability Verifier
An offline Python verifier that explains how synthetic cloud identities reach permissions through grants, role trust, wildcard patterns, and multi-step role assumption.

Project definition
Problem statement
A cloud identity can gain sensitive access through several individually plausible statements. Direct grants, role trust, wildcards, and chained role assumption can combine into a path that is difficult to see during manual review.
The project models these relationships as a directed graph and retains the exact identity path and policy statement behind a decision. It uses synthetic policies and does not connect to a cloud account.
Project objectives
- Validate a strict provider-neutral policy containing principals, roles, resources, grants, and expected decisions.
- Apply implicit denial and explicit-deny precedence to subject, action, and resource requests.
- Build role-assumption edges only when both permission and role trust match.
- Calculate reachable roles and the shortest explanation trace for sensitive access.
- Report unexpected access, missing access, admin reachability, wildcard trust, external trust, trust cycles, and ineffective denies.
- Compare policy revisions and measure detection accuracy and runtime scaling.
Project structure
Project components
Policy model
Checks required fields, unknown fields, types, identifiers, uniqueness, relations, and file size.
Permission evaluator
Matches exact and wildcard grants and applies explicit-deny precedence.
Assumption graph
Creates directed edges from permission and matching role trust.
Access tracer
Finds reachable roles and returns the shortest identity path with statement evidence.
Finding engine
Produces seven structured defensive finding types with stable codes and severity.
Experiment suite
Evaluates labelled vulnerable and corrected policies and records scaling measurements.
Methodology
Project workflow
- 01Prepare policy
Use one included synthetic policy or create another document under the strict schema.
- 02Evaluate grants
The verifier records matching allow and deny statements for each requested tuple.
- 03Build graph
AssumeRole permission and target-role trust are combined into directed transitions.
- 04Trace access
Reachable roles are searched for a requested permission and the shortest supporting path is retained.
- 05Review findings
JSON findings, graph output, and the revision comparison are inspected with their evidence.
Demonstration scenario
An external vendor can assume a pivot role that can assume an administrative role. The verifier explains the complete path to a protected secret. A corrected policy adds one explicit deny, and the comparison shows that the critical access and vendor admin path are resolved without a new finding.
Engineering
Tools and method
- Python package
- Typed modules for policy parsing, pattern matching, graph analysis, scenarios, experiments, and commands.
- Graph analysis
- NetworkX directed graphs for descendants, shortest paths, and strongly connected components.
- Portable evidence
- JSON findings, CSV scenarios, Graphviz DOT, a static results page, and eight labelled figures.
- Quality controls
- 71 tests, 98.16 percent statement coverage, Ruff checks, dependency audit, repository validation, and document accessibility audits.
Testing
Evaluation
Evaluation measures
- Unexpected-access precision, recall, and accuracy across 200 labelled scenarios
- True-positive, true-negative, false-positive, and false-negative counts
- Findings resolved or introduced after adding an explicit deny
- Median and P95 full-analysis time from 10 to 400 roles
- Exact identity-path and permission-statement evidence
- Automated tests and statement coverage across every module
Project boundaries
- All included identities, accounts, policies, resources, and findings are synthetic.
- The project does not accept credentials, connect to cloud accounts, or change infrastructure.
- The provider-neutral schema does not reproduce every AWS, Azure, or Google Cloud policy feature.
- Perfect prepared-case accuracy does not establish accuracy on production policy collections.
- No information is collected.
Included
- 01Complete Python source code
- 02Strict synthetic policy format and example policies
- 03Permission decisions, reachability graph, and exact access traces
- 04Seven defensive finding types and policy comparison
- 05118-page project documentation in PDF and editable Word formats
- 0613-page setup and usage guide in PDF and editable Word formats
- 0771 automated tests, retained results, and eight generated figures
Project record
No information is collected on this page.
- Permanent project ID
- GP-CY-0WXHTZB
- Catalogued
- 21 Aug 2026
- Completed
- 24 Aug 2026
- Verified
- 24 Aug 2026
- Demonstration
- Included in repository
Handover
After purchase
- 01Payment is confirmed
The project is marked unavailable and cannot be purchased again.
- 02Repository access is granted
The buyer's submitted GitHub account receives access to the private repository.
- 03The purchase record is delivered
The certification sheet is prepared from the reviewed buyer details and sent privately by email.