← Back to project catalogue
GP-CY-0WXHTZBCybersecurityReady

Cloud Identity Policy Reachability Verifier

An offline Python verifier that explains how synthetic cloud identities reach permissions through grants, role trust, wildcard patterns, and multi-step role assumption.

Cloud Identity Policy Reachability Verifier project visual
GP-CY-0WXHTZB · Cybersecurity
  • Python
  • NetworkX
  • Matplotlib
  • Graphviz DOT

Project definition

Problem statement

A cloud identity can gain sensitive access through several individually plausible statements. Direct grants, role trust, wildcards, and chained role assumption can combine into a path that is difficult to see during manual review.

The project models these relationships as a directed graph and retains the exact identity path and policy statement behind a decision. It uses synthetic policies and does not connect to a cloud account.

Project objectives

  • Validate a strict provider-neutral policy containing principals, roles, resources, grants, and expected decisions.
  • Apply implicit denial and explicit-deny precedence to subject, action, and resource requests.
  • Build role-assumption edges only when both permission and role trust match.
  • Calculate reachable roles and the shortest explanation trace for sensitive access.
  • Report unexpected access, missing access, admin reachability, wildcard trust, external trust, trust cycles, and ineffective denies.
  • Compare policy revisions and measure detection accuracy and runtime scaling.

Project structure

Project components

01

Policy model

Checks required fields, unknown fields, types, identifiers, uniqueness, relations, and file size.

02

Permission evaluator

Matches exact and wildcard grants and applies explicit-deny precedence.

03

Assumption graph

Creates directed edges from permission and matching role trust.

04

Access tracer

Finds reachable roles and returns the shortest identity path with statement evidence.

05

Finding engine

Produces seven structured defensive finding types with stable codes and severity.

06

Experiment suite

Evaluates labelled vulnerable and corrected policies and records scaling measurements.

Methodology

Project workflow

  1. 01
    Prepare policy

    Use one included synthetic policy or create another document under the strict schema.

  2. 02
    Evaluate grants

    The verifier records matching allow and deny statements for each requested tuple.

  3. 03
    Build graph

    AssumeRole permission and target-role trust are combined into directed transitions.

  4. 04
    Trace access

    Reachable roles are searched for a requested permission and the shortest supporting path is retained.

  5. 05
    Review findings

    JSON findings, graph output, and the revision comparison are inspected with their evidence.

Demonstration scenario

An external vendor can assume a pivot role that can assume an administrative role. The verifier explains the complete path to a protected secret. A corrected policy adds one explicit deny, and the comparison shows that the critical access and vendor admin path are resolved without a new finding.

Engineering

Tools and method

Python package
Typed modules for policy parsing, pattern matching, graph analysis, scenarios, experiments, and commands.
Graph analysis
NetworkX directed graphs for descendants, shortest paths, and strongly connected components.
Portable evidence
JSON findings, CSV scenarios, Graphviz DOT, a static results page, and eight labelled figures.
Quality controls
71 tests, 98.16 percent statement coverage, Ruff checks, dependency audit, repository validation, and document accessibility audits.

Testing

Evaluation

Evaluation measures

  • Unexpected-access precision, recall, and accuracy across 200 labelled scenarios
  • True-positive, true-negative, false-positive, and false-negative counts
  • Findings resolved or introduced after adding an explicit deny
  • Median and P95 full-analysis time from 10 to 400 roles
  • Exact identity-path and permission-statement evidence
  • Automated tests and statement coverage across every module

Project boundaries

  • All included identities, accounts, policies, resources, and findings are synthetic.
  • The project does not accept credentials, connect to cloud accounts, or change infrastructure.
  • The provider-neutral schema does not reproduce every AWS, Azure, or Google Cloud policy feature.
  • Perfect prepared-case accuracy does not establish accuracy on production policy collections.
  • No information is collected.

Included

  1. 01Complete Python source code
  2. 02Strict synthetic policy format and example policies
  3. 03Permission decisions, reachability graph, and exact access traces
  4. 04Seven defensive finding types and policy comparison
  5. 05118-page project documentation in PDF and editable Word formats
  6. 0613-page setup and usage guide in PDF and editable Word formats
  7. 0771 automated tests, retained results, and eight generated figures

Project record

No information is collected on this page.

Permanent project ID
GP-CY-0WXHTZB
Catalogued
21 Aug 2026
Completed
24 Aug 2026
Verified
24 Aug 2026
Demonstration
Included in repository

Handover

After purchase

  1. 01
    Payment is confirmed

    The project is marked unavailable and cannot be purchased again.

  2. 02
    Repository access is granted

    The buyer's submitted GitHub account receives access to the private repository.

  3. 03
    The purchase record is delivered

    The certification sheet is prepared from the reviewed buyer details and sent privately by email.