They weren’t created all at once. They crept in over months and years, spawned by every new feature, microservice, and urgent patch. One role for a dev test. One more for a temp contractor. Dozens from automation you don’t even remember setting up. Until one morning you open your IAM console and scroll for far too long. You’ve got a Large-Scale Role Explosion.
Cloud IAM role explosion happens fast. One team creates a custom role. Another team copies it and tweaks a single permission. Automation scripts spit out temporary roles that never get deleted. Third-party services add their own when you integrate them. Soon, you have hundreds—sometimes thousands—of roles. Most overlap. Many have excessive permissions. Some are orphaned. All are risk.
The security cost compounds. Attackers love unmonitored, over-permissioned roles. Auditors flag them. Engineers waste time picking through them to understand who has access to what. Confusion leads to mistakes. Least privilege turns into “who knows?” Privilege creep becomes privilege chaos.
The problem scales with your cloud footprint. A startup can clean things up in a day. A large enterprise finds itself with years of IAM role sprawl. Tagging and documentation help, but the sheer number of resources, services, and environments means the creep is constant. Manual reviews become impossible. Scripts catch only what you know to look for. Even IAM policies designed for security fail if you don’t control role creation in the first place.