NHI Anomaly Detection for AWS — IdentityLens Cloud

IdentityLens Cloud answers the second governance question: what are the non-human identities in a cloud account actually doing, and when does that behavior stop looking normal? Agents, CI pipelines, and service accounts now act with real privileges — and their identity trail is where abuse shows up first.

How it observes

Ingestion is deliberately read-only. The collector reads a recent window of CloudTrail events and takes a read-only IAM snapshot — users, roles, access keys, and managed policy documents. It writes nothing to the observed account. Both a fixture mode (deterministic synthetic events, used for demos and CI) and a real-AWS mode are supported.

Every identity observed is classified — human, AWS service, or agent-like — because scope rules differ: action-detection applies to non-human and agent identities, baselines apply to all in-scope identities.

What it detects

The engine, built and running in MVP form today:

Detector	Purpose
Privilege escalation	Identity activity granting or escalating permissions
New identity creation	Identities created by identities that shouldn't create identities
Cross-account role assumption	Role-hopping across account boundaries
Off-hours access	Activity outside an identity's observed schedule
Unusual API call volume	Sudden discovery- or automation-shaped spikes
New region or IP	Activity from places the identity has never appeared
Dormant key reactivation	Access keys waking up after long silence

Baselines are per-identity, with per-identity overrides, silent periods, and an allowlist for known-good patterns.

Alert workflow

Anomalies open as alerts with severity, detector attribution, and event evidence. Alerts can be acknowledged, closed, and reopened, and a persistent audit log records every state change. Delivery is strictly once per anomaly per channel — an alert that fails to send is logged and retried on the next cycle, and alerting can never break ingestion.

Status

The detection engine, observability modes, and alert workflow are built and running as an MVP. Multi-tenant cloud delivery — per-tenant cross-account read-only roles, per-tenant credential isolation, and a shared console — is on the roadmap. GCP and Azure log sources are part of that plan, joining AWS CloudTrail under the same read-only ingestion model. IdentityLens Cloud is currently in MVP development.