RivasSec

Infrastructure. Security. Insight.

Field notes on infrastructure security, cloud hardening, Kubernetes, IAM, and OSINT by RivasSec.

Testing an IAM Analyzer Against Its Own Claims

Posted on Mon 24 August 2026 in DevSecOps • 5 min read

aws
iam
security-tooling
testing
devsecops

I built a client-side IAM blast-radius analyzer, then validated it against 100 adversarial cases I did not write. The useful results were two places a green build hid a wrong answer, and the same principle fixed both.