Preventing Cloud Privilege Bloat: A JIT/PIM Design Guide for Azure, AWS, and GCP

 

"We don't know who has what authority anymore."
"The project is over, but the AWS role remains."
"The account of the retiree was discovered six months later"

Even if you are told to "take inventory" in authority management, it is difficult to continue doing it regularly.
That's why it's important to design an architecture that says "permissions are limited."

1. Why is authority bloated?

Authority is easy to grant, but difficult to revoke.
The reasons are:

• "Let's ask someone before taking it off" becomes an afterthought.
• Fear that something might break if you take it off
• Whose job it is is unclear who is responsible for the inventory of permissions

As a result, unused authority accumulates, and after one year, no one can grasp the whole picture.

This means an increase in the attack surface.

2. Applying JIT/PIM Ideas to the Cloud

Just-In-Time Access (JIT) and Privileged Identity Management (PIM)
It is the concept that "the necessary person has the necessary authority, only the necessary time, and the necessary authority".

Microsoft Entra ID (formerly Azure AD) has commercialized it as PIM.
Let's extend this mindset to AWS and GCP.

3. Entra ID PIM: Implementation Basics

Microsoft Entra PIM allows you to manage permissions as "Eligible" instead of "always granted".

Operating Flow:

1. Users usually only have general privileges
2. Request "Enable Permissions" in PIM when needed
3. Enter the reason and duration (e.g., 4 hours)
4. Approver (manager, etc.) approves
5. Automatically revoke permissions when the deadline is up

PIM Setup Points:

• Global administrators and privileged role administrators must be subject to PIM
• Require MFA on activation
• Log all activations in the Audit Log

4. AWS: Access Control in IAM Identity Center

AWS IAM Identity Center (formerly SSO) allows you to assign roles with a limited time.

Key points:

• No IAM user creation, centralized management in IAM Identity Center
• Set the expiration date (session time) for the Permission Set
• Turn access requests into an approval flow in Slack (combined with AWS Service Catalog)

You can also use IAM Access Analyzer to automatically detect permissions that aren't actually being used.

bash

# Check for unused access with IAM Access Analyzer
aws accessanalyzer list-findings \
  --analyzer-arn arn:aws:access-analyzer:region:account:analyzer/analyzer-name \
  --filter '{"findingType": {"eq": ["UnusedIAMRole"]}}'

5. GCP: Time-bound IAM binding

GCP's IAM can be expired using the Condition feature.

bash

# 24-hour permission grant
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:engineer@example.com" \
  --role="roles/cloudsql.admin" \
  --condition="expression=request.time < timestamp('2026-02-19T00:00:00Z'),title=temporary-access"

これをTerraformやスクリプトで自動化することで、「期限付き権限付与ワークフロー」が構築できます。

6. How to graduate the inventory

Stop the "semi-annual inventory" and design it like this:

Design Policy:

• High authority (equivalent to administrator/owner) must be via JIT/PIM
• General authorization also expires after 90 days and must be reapplied
• All approvals and usage history are linked to the SIEM

This allows you to maintain the state of "permissions are always minimal without taking inventory".

7. Colorkrew Security's Approach

The approach of "taking stock of authority once every six months" will inevitably fail as the organization grows. JIT/PIM "time-bound permission design" always automatically minimizes permissions once a mechanism is established.

That said, getting the right combination of Entra PIM, IAM Identity Center, and GCP Condition requires environment-specific design decisions. If you are unsure about the optimal implementation for your cloud environment, the shortest route is to consult an expert first. Colorkrew Security consistently supports permission design, JIT implementation, and SIEM integration for multi-cloud environments.