Coarse-Grained Role Design

What this finding is

Roles exist and are not administrative, but each grants more than its holders need — a single 'developer' role spanning every service, read access to all data rather than to the relevant subset, or environments sharing one role definition. This is refinement of an already-functioning model, not the absence of one.

Why it is Tier 3

Role refinement reduces blast radius incrementally, and each iteration reduces what a compromised account yields. It is Tier 3 because a working role model already exists and the residual excess is bounded — where roles carry administrative privilege the finding is BCN-T1-IAM-002 instead. This work compounds: teams that refine roles continuously accumulate far fewer Tier 1 privilege findings.

How to detect it

1. 1Compare granted against exercised permissions per role using provider access analysers.
2. 2Identify roles shared across functions or environments, which necessarily grant the union of every holder's needs.
3. 3Look for roles whose membership has grown well beyond the population originally intended.
4. 4Check whether non-production environments reuse production role definitions.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1. 1Split multi-purpose roles along observed usage boundaries, starting with the most widely-held.
2. 2Separate role definitions per environment so non-production access cannot reach production.
3. 3Scope data access to the relevant subset rather than granting estate-wide read.
4. 4Adopt attribute-based conditions where the platform supports them, reducing the number of discrete roles required.
5. 5Re-derive role scope from usage data periodically so definitions track how teams actually work.

How to verify the fix

Mappings

Other Tier 3 findings in Identity & Access Management