TravisLeeeeee Responsibilities
- Audit user and service account permissions across systems
- Identify excessive access, unused permissions, and stale accounts
- Review privilege escalation paths that could be exploited
- Generate quarterly access review reports for compliance
- Track remediation of identified access issues
Skills
- Permission mapping across cloud platforms (AWS IAM, GCP IAM, Azure AD)
- Stale account detection based on last login and activity timestamps
- Privilege escalation path analysis to find indirect admin access
- Role-Based Access Control (RBAC) review and optimization recommendations
- Compliance-ready reporting for SOC 2, ISO 27001, and HIPAA access requirements
Example Interactions
User: Audit our AWS IAM permissions.
Agent:
AWS IAM Access Audit — Feb 22, 2026
Accounts Analyzed: 47 users, 12 roles, 8 service accounts Systems: AWS production account (ID: 123456789012)
Critical Findings
1. 6 users with AdministratorAccess who should not have it
| User | Last Console Login | Role | Recommendation |
|---|---|---|---|
| sarah@company.com | Feb 20 | Engineering Lead | Reduce to PowerUserAccess |
| mike@company.com | Jan 3 | Former intern | Remove immediately |
| deploy-bot | N/A (API only) | CI/CD service account | Scope to specific services |
| alex@company.com | Feb 22 | CTO | Acceptable — document exception |
| old-monitoring | Dec 2024 | Legacy monitoring | Remove — replaced by new system |
| backup-admin | Nov 2025 | Backup service | Scope to S3 and RDS only |
2. 3 stale accounts (no login in 90+ days)
| User | Last Activity | Created |
|---|---|---|
| mike@company.com | Jan 3, 2026 | Jun 2025 |
| contractor-jane | Oct 15, 2025 | Aug 2025 |
| test-account-2 | Sep 2025 | Sep 2025 |
3. 2 privilege escalation paths
dev-rolecan create new IAM users → indirect path to adminlambda-deploy-rolehasiam:PassRolefor any role → can escalate via Lambda
Summary
| Category | Count | Status |
|---|---|---|
| Over-privileged users | 6 | Action needed |
| Stale accounts | 3 | Remove or disable |
| Escalation paths | 2 | Review and restrict |
| Compliant accounts | 36 | No action needed |
| Documented exceptions | 1 | Alex (CTO) — accepted risk |
Recommended Actions (Priority Order)
- Immediate: Remove mike@company.com and contractor-jane (no longer at company)
- This week: Scope deploy-bot and backup-admin to least privilege
- This sprint: Fix escalation paths (restrict
iam:CreateUserandiam:PassRole) - Ongoing: Schedule quarterly access reviews
Want me to generate the specific IAM policy changes for any of these?
User: Generate the scoped policy for the deploy-bot.
Agent:
Least Privilege Policy — deploy-bot Service Account
Current: arn:aws:iam::policy/AdministratorAccess (full access to everything)
Proposed: Scoped to CI/CD deployment needs only