Design an IAM Permission Audit System
Last updated: December 9, 2025
Quick Overview
Design a system that analyzes IAM policies across multi-cloud environments to identify over-privileged accounts, unused permissions, and potential privilege escalation paths.
Wiz
December 9, 202515
11
3,218 solved
Design a system that analyzes IAM policies across multi-cloud environments to identify over-privileged accounts, unused permissions, and potential privilege escalation paths.
IAM (Identity and Access Management) is one of the most complex and error-prone aspects of cloud security. Over-permissive IAM policies are a leading cause of cloud breaches. Wiz's IAM analysis must parse complex policy documents, resolve inheritance and cross-account trust relationships, and identify actionable risks.
What the Interviewer Expects
- Parse and normalize IAM policies across different cloud providers
- Build a permission graph that resolves inheritance, groups, and cross-account trust
- Identify over-privileged accounts by comparing granted vs used permissions
- Detect privilege escalation paths through permission chaining
- Present findings in a way that's actionable for security teams
Key Topics to Cover
How to Approach This
- Start by clarifying functional and non-functional requirements with the interviewer.
- Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
- Draw a high-level architecture first, then deep dive into 1-2 critical components.
- Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
- Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
- How do you determine which permissions are actually unused versus rarely used?
- How would you handle cross-cloud IAM analysis (e.g., Azure AD federated to AWS)?
- How do you prioritize which over-privileged accounts to remediate first?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice System Design ProblemsSample Answer
Requirements
- Functional Requirements:
- Parse IAM policies from AWS, Azure, and GCP to normalize them into a unified format.
- Construct a permission graph that includes roles, users, groups, and t...
Capacity Estimation
- Assume each cloud provider has 100,000 IAM policies, with an expected increase of 10% annually.
- Each policy can have an average of 15 permissions.
- The system needs to handle 1 million IAM po...
Submit Your Answer
