Modern software systems rely on mining insights from business sensitive data
stored in public clouds. A data breach usually incurs significant (monetary)
loss for a commercial organization. Conceptually, cloud security heavily relies
on Identity Access Management (IAM) policies that IT admins need to properly
configure and periodically update. Security negligence and human errors often
lead to misconfiguring IAM policies which may open a backdoor for attackers. To
address these challenges, first, we develop a novel framework that encodes
generating optimal IAM policies using constraint programming (CP). We identify
reducing dark permissions of cloud users as an optimality criterion, which
intuitively implies minimizing unnecessary datastore access permissions.
Second, to make IAM policies interpretable, we use graph representation
learning applied to historical access patterns of users to augment our CP model
with similarity constraints: similar users should be grouped together and share
common IAM policies. Third, we describe multiple attack models and show that
our optimized IAM policies significantly reduce the impact of security attacks
using real data from 8 commercial organizations, and synthetic instances.

本文提出了一种基于约束编程和图表示学习的新型 IAM 框架，通过减少无关数据存储访问权限等优化 IAM 策略，并对 IAM 策略进行解释和分类，以减少安全攻击的影响。