PALO Alto Networks’ Unit 42 has described a method for identifying the functional roles of cloud identities from their behaviour, rather than relying only on assigned IAM permissions or names. The researchers analysed more than 40,000 identities across 125 cloud environments over two months, using AWS CloudTrail records. They found recurring behavioural groups corresponding to administrators, DevOps and CI/CD systems, security tools, backup agents, networking components and FinOps platforms.
This matters because over-privileged identities and generic or misleading labels can obscure what an account normally does, making suspicious activity harder to spot.
The approach converts each identity’s invoked AWS operations into a sparse vector, then uses UMAP for dimensionality reduction and HDBSCAN to identify clusters.
In the largest example, roughly 5,000 identities across more than 100 projects were classified as administrative users operating mainly through the AWS Management Console: about 94% invoked `ConsoleLogin`, compared with fewer than 1% of identities in other clusters, while around 60% used console-related operations such as `GetCostAndUsage` and `GetCostForecast`. Unit 42 says the clustering can be distilled into interpretable logistic-regression rules containing a few dozen weighted operations.
These rules can be implemented in standard SQL to classify new identities without repeatedly running the full machine-learning pipeline, helping teams detect behaviour that deviates from an identity’s established role. The researchers say the method could also be extended to other cloud providers, SaaS and Kubernetes audit data.