Overview of role recommendations

Role recommendations help you identify and remove excess permissions from your principals, improving your resources' security configurations.

Overview of role recommendations

Role recommendations are generated by the IAM recommender. The IAM recommender is one of the recommenders that Recommender offers.

Each role recommendation suggests that you remove or replace a role that gives your principals excess permissions. At scale, these recommendations help you enforce the principle of least privilege by ensuring that principals have only the permissions that they actually need.

The IAM recommender identifies excess permissions using policy insights. Policy insights are ML-based findings about a principal's permission usage.

Some recommendations are also associated with lateral movement insights. These insights identify roles that allow service accounts in one project to impersonate service accounts in another project. For more information, see How lateral movement insights are generated.

How policy insights are generated

Policy insights highlight the permissions in a principal's roles that the principal isn't using.

The IAM recommender generates policy insights by comparing a principal's total number of permissions with the permissions that the principal used in the last 90 days. If the role was granted fewer than 90 days ago, the IAM recommender looks at the principal's permission usage in the time since the principal was granted the role.

There are a few ways in which a principal can use a permission:

• Directly, by calling an API that requires the permission

  For example, the roles.list method in the IAM REST API requires the iam.roles.list permission. When you call the roles.list method, you use the