Who has administrative access to my production AWS account? This seems like a simple question, right? Isn't it just the users who have the AdministratorAccess policy applied to them? Unfortunately, it's not that simple. 

In this talk, we’ll follow along as Bob, a fictional Security Engineering Manager, tries to answer this question for Madeline, his CISO. We’ll see that, while it seems like a straightforward question, it’s unfortunately more complicated than it appears. 

The truth is, your identity threat model needs to account for transitive trust relationships and privilege escalation. Not only that, it also needs to extend beyond your production AWS account to include anything your production account trusts—your CI/CD tooling, other AWS accounts, other cloud providers, and even third-party SaaS platforms might offer exploitable paths that lead to your most sensitive production data.