IAM Visualizer

Interactive graph of users, roles, groups, and resources across AWS, GCP, Azure, and app-level RBAC — with automatic over-privilege detection.

Overview

IAM Visualizer renders your identity-and-access-management principals — users, groups, roles, and resources across AWS, GCP, Azure, and TotalApp's own app-level RBAC — as an interactive node graph. Permission edges connect principals to the resources they can reach, and any principal holding broad permissions unused in the last 90 days is automatically flagged as over-privileged.

Visualization, not enforcement

IAM Visualizer reads and displays your current permission model — it does not modify permissions itself. Use it to identify over-privileged principals, then remediate them in the source IAM system (AWS console, GCP IAM, Azure RBAC, or TotalApp's own Roles screen).

Quick Start

Open IAM Visualizer from the Security sidebar. The graph loads automatically, laid out by principal kind (users, groups, roles, resources).
Click any node to see its full permission list and connections in the right-hand panel.
Toggle Over-privileged in the header to dim every node except the flagged ones.
Search by principal name to highlight matching nodes and dim the rest.
With nothing selected, the right panel lists every over-privileged principal for a quick scan.

Principal Kinds & Providers

Kind	Example
User	An individual account, e.g. `alice@totalapp.app` or a service account like `svc-ci-deploy`.
Group	A collection of users, e.g. `engineering`, `data-team`.
Role	An assumable permission set, e.g. `AdministratorAccess`, `ReadOnlyAccess`, or an app-level role like `tenant-admin`.
Resource	A protected target, e.g. an S3 bucket, a database, or an internal app module.

Supported providers: AWS IAM, GCP IAM, Azure RBAC, and TotalApp's application-level RBAC.

Features

Interactive Graph

Pan, zoom, and click any node to inspect its permission edges. The minimap colours over-privileged nodes red for quick orientation.

Over-Privilege Flagging

Principals holding broad permissions (e.g. *:*) unused in the last 90 days are automatically flagged and listed in the right panel.

Search & Filter

Search by principal name, or toggle the Over-privileged filter to dim every node except flagged ones.

AI Assistant

Every screen in Security Hub now ships with an embedded AI Assistant, opened from the vertical AI Assistant tab on the right edge of the screen. The assistant reads the data currently on screen — the full IAM principal graph — kind, provider, permissions, last-used, and over-privileged flag — and answers questions, triages findings, or drafts a remediation plan directly in the chat panel.

Risk Summary

Get a plain-language summary of your current IAM risk posture — how many principals are over-privileged and which carry the broadest permissions.

Riskiest Principals

Ask which principals carry the riskiest permissions right now, referenced by name.

Least-Privilege Fixes

Get concrete least-privilege remediation suggestions for over-privileged principals, tied to the actual permission that should be scoped down.

Save as Report & Add Knowledge

Any assistant reply can be saved as a report (available later from My Reports) via the Save as Report button under the last message. Click Add Knowledge in the input dock to attach files or notes from your Knowledge library so the assistant's answers can reference them.

FAQ

Does IAM Visualizer change permissions when I use it?

No. It is a read-only visualization — remediate flagged principals in the actual IAM system (AWS, GCP, Azure, or TotalApp Roles) after identifying them here.

What does "over-privileged" mean here?

A principal is flagged when it holds broad permissions (e.g. a wildcard grant) that have gone unused for the last 90 days — a strong signal the grant is broader than the principal actually needs.