Cloud security posture is mostly maintenance

Permissions do not stay clean on their own. In any environment with roles, groups, or service principals, access gets added for a task and then stays in place after the task ends.

The pattern is consistent. Someone needs a new permission to finish a deployment or fix an issue. The permission is granted. The work moves on. The removal step is skipped because it does not feel urgent at the time.

Over months this produces identities that carry far more access than their current workloads require. The extra permissions do not help operations. They only increase the number of paths an attacker could use.

The review itself is straightforward. I list the identities attached to a workload, check what they actually call in practice, and compare that against the permissions they hold. Anything that no longer matches a live requirement becomes a candidate for removal.

The real discipline is not the review. It is the decision to treat removal as normal work. When cleanup is handled the same way as any configuration change, it happens regularly instead of waiting for a formal audit or a security incident.

The question that guides the work is always the same. Does this identity still need this permission for what runs today? Answering that question on a regular cadence prevents the slow growth of unnecessary access.