Which IAM misconfiguration in cloud environments is most commonly seen and should be checked by a pentester?

• A. Requiring MFA for all users
• B. Assigning broad permissions that grant users more access than needed
• C. Enforcing least privilege
• D. Auditing permission changes every 90 days

Answer: (B)

Cloud IAM should be driven by the principle of least privilege, giving users only the access they actually need. The most common misconfiguration seen by pentesters is granting broad permissions that exceed what a user or service requires. When roles or policies allow wide access—often with wildcard actions or resources—it creates an easy path for abuse: a compromised account or a negligent insider can perform unintended actions, access sensitive data, or pivot to other parts of the environment. This misconfiguration directly expands the attack surface and is something attackers are most likely to exploit, which is why it’s the primary focus for a pentest.

Controls like requiring MFA for all users, enforcing least privilege, or auditing permission changes are important governance and security practices, but they describe desirable states or processes rather than the misconfiguration itself. The core issue a tester looks for is those overly permissive permissions that grant more access than needed.