Detect Cycles in Cloud IAM Permission Chains
Last updated: December 9, 2025
Quick Overview
Given a set of IAM policies and role assumption chains across cloud accounts, detect circular permission chains that could lead to privilege escalation. Model this as a graph problem.
Wiz
December 9, 20256
3
4,208 solved
Given a set of IAM policies and role assumption chains across cloud accounts, detect circular permission chains that could lead to privilege escalation. Model this as a graph problem.
Circular IAM permission chains are a real security risk. If Role A can assume Role B, and Role B can assume Role A, an attacker who compromises either role effectively has the permissions of both. More complex cycles across multiple roles and accounts can create unexpected privilege escalation paths. This problem tests your ability to model real security concepts as graph problems.
What the Interviewer Expects
- Model IAM roles and assume-role relationships as a directed graph
- Implement cycle detection using DFS with proper coloring (white/gray/black)
- Return the actual cycle path, not just boolean detection
- Handle multiple disconnected components
- Analyze complexity and discuss real-world implications
Key Topics to Cover
How to Approach This
- Clarify input constraints and edge cases before writing code.
- Walk through your approach verbally and confirm with the interviewer before coding.
- Start with a brute force solution, then optimize. Mention time and space complexity.
- Test your solution with examples, including edge cases like empty input or duplicates.
- Consider common patterns: sliding window, two pointers, hash map, BFS/DFS, dynamic programming.
Possible Follow-up Questions
- How would you extend this to detect cycles across different cloud providers?
- What if some edges are conditional (can only assume role during business hours)?
- How would you rank detected cycles by security severity?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice DSA ProblemsSample Answer
Problem Analysis
This problem requires us to detect cycles in a directed graph, where nodes represent IAM roles and directed edges represent the ability to assume roles. Given that circular permissions can lead to pri...
Approach
- Model the IAM roles as a directed graph: Create an adjacency list where each role points to the roles it can assume. For example, if Role A can assume Role B and Role C, the adjacency list entr...
Submit Your Answer
