Identity & access risk

Sensitive data is only as safe as the identities that can reach it. Argus runs a read-only sweep of your IAM users, roles, groups, and policies, links each one to the datastores it can access, and scores it for risk - so “who can get to our crown-jewel data, and which of them shouldn’t” becomes a ranked list instead of a manual audit.

This is a separate engine from datastore risk. Datastore risk asks “how exposed is this data?”; identity risk asks “how dangerous is this principal?” The two connect through access: an identity’s reach into sensitive datastores is one of the things that raises its score, and an identity’s risk feeds back into the reachability of the data it can touch.

What gets scored

Discovery classifies every principal as a user, role, service identity, or group, and flags whether it is external (trusted from outside your account). Each identity is then evaluated against a set of risk signals:

• Over-privileged - holds far more access than it actually uses, or carries admin-level permissions. Argus compares granted permissions against real usage to spot the gap.
• Missing MFA - a human user with console access and no multi-factor enrolled.
• Sensitive-data access - can reach datastores containing PII, PHI, or financial data.
• Stale - no activity for a long stretch, or provisioned and never used.
• Cross-account trust - an external or cross-account principal that can assume access.
• Access-key hygiene - multiple active keys, or keys that are unused or long past a healthy rotation age.
• Password age - console credentials that have not been rotated in a long time.

Each signal that fires contributes to a 0 to 100 risk score, weighted by how much it actually matters - over-privilege and missing MFA weigh more than an aged password. The score maps to a Low / Medium / High / Critical band.

Toxic combinations

Some problems are worse together than the sum of their parts, and the score reflects that. An identity with admin access that can also reach sensitive data is escalated straight to Critical, regardless of what the individual signals would have totaled - that is the exact profile an attacker wants, and it should never sit quietly in the middle of the list. Admin access on its own floors an identity at High.

The exact weights, band cutoffs, and the day-count thresholds behind “stale” and “aged” are tuned internally, but the direction is always intuitive: more unused privilege, weaker authentication, more reach into sensitive data, and more external trust all raise the score.

The access-risk heat map

The heat map gives you the whole access surface in one grid. Its rows are identity types (user, service, role, group) and its columns are resource types (S3, RDS, DynamoDB, Redshift, or all resources). Each cell shows the number of access grants for that combination, colored by the worst identity risk in that bucket. A hot red cell where roles meet S3 tells you at a glance that some role with access to object storage is carrying critical risk, and gives you a direct path to drill in.

From signals to alerts

Not every finding needs to page someone. Argus turns identity findings into recommendations, and only the high-severity ones become alerts - an over-privileged identity or a console user without MFA will raise an alert; a merely aged access key becomes a recommendation you can work through without the interrupt. Identity alerts resolve themselves automatically once the underlying problem is fixed and the next discovery confirms it, so the list reflects reality rather than accumulating stale noise.

Running IAM discovery and working these findings is covered in Identity & Access.

Everything on this page depends on the ArgusIdentityRead statement being present on the agent’s role. Without it, identity discovery cannot run and the identity pages are simply empty - see IAM permissions.