See How Identities, Permissions, Roles, and Resources Are Connected
AWS IAM resources are usually reviewed separately. Users appear in one place, roles in another, policies in another, and trust relationships somewhere else.
Securitain connects these objects into a visual relationship graph so security teams can understand how access is granted, inherited, assumed, and potentially abused.
Why a relationship graph is needed
An IAM user may appear to have limited permissions when reviewed individually. However, that user may inherit permissions from a group, assume a role, pass a role to an AWS service, or access resources through another account.
The real security risk becomes visible only when these relationships are examined together.
Securitain helps answer:
- 1Which policies influence this identity?
- 2Which roles can this user or role assume?
- 3Which external accounts are trusted?
- 4Which services and resources can ultimately be reached?
- 5What is the potential impact if this identity is compromised?
How the graph works
Nodes represent AWS security objects
Each node represents an identity, permission, account, service, or resource.
- IAM users
- IAM groups
- IAM roles
- Managed and inline policies
- Permission sets
- AWS accounts
- Federated identities
- AWS services
- Protected resources
Connections explain access
The lines between nodes describe how access is created.
- Member of
- Policy attached to
- Can assume
- Can pass role
- Trusted by
- Can access
- Federated through
- Can escalate to⚠
Follow the complete access path
Consider an IAM user called dev-user.
The user belongs to the Developers group. A policy attached to that group allows the user to call sts:AssumeRole on CloudOpsRole.
If the trust policy of CloudOpsRole allows the relevant principal, the user can assume the role and receive its permissions.
The role may then provide access to:
- Production S3 buckets
- Secrets Manager secrets
- Lambda functions
- DynamoDB tables
- RDS databases
- Other sensitive workloads
The user may look low-risk when reviewed alone. The relationship graph reveals the complete path to the protected resource.
Identify identity blast radius
Securitain helps security teams understand the blast radius of a user, role, permission set, or credential.
The graph shows:
- Directly connected policies
- Inherited permissions
- Reachable roles
- Trusted accounts
- Accessible services
- Sensitive resources
- Related findings
- Privilege-escalation paths
This allows investigators to understand not only that an identity is risky, but exactly why it is risky and what could be affected.
Investigate from the graph
Security teams can select a node and investigate:
- Identity risk score
- MFA status
- Active access keys
- Administrator capability
- External trust
- Connected roles and policies
- Effective permissions
- Related security findings
- Recommended remediation
The graph becomes the starting point for deeper investigation rather than only a visualization.
Remediate the relationship, not just the symptom
Securitain helps identify the most appropriate point at which to break a risky access path.
Recommended actions may include:
- Removing unnecessary sts:AssumeRole
- Restricting role ARNs
- Limiting iam:PassRole
- Strengthening role trust policies
- Removing wildcard permissions
- Reducing role privileges
- Applying permission boundaries
- Enforcing MFA
- Removing unused access keys
- Adding organizational guardrails
After the AWS configuration is corrected, Securitain can rescan the environment and verify whether the risky path still exists.
Understand Who Can Reach What—and Exactly How
Securitain turns separate IAM resources into one explainable access model, from the original identity to the final AWS account, service, or protected resource.