{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/using-constraint-programming-and-graph","title":"Using Constraint Programming and Graph Representation Learning for Generating Interpretable Cloud Security Policies","arxiv_id":"2205.01240","date":"2022-05-02","proceeding":null,"authors":["Mikhail Kazdagli","Mohit Tiwari","Akshat Kumar"],"abstract":"Modern software systems rely on mining insights from business sensitive data stored in public clouds. A data breach usually incurs significant (monetary) loss for a commercial organization. Conceptually, cloud security heavily relies on Identity Access Management (IAM) policies that IT admins need to properly configure and periodically update. Security negligence and human errors often lead to misconfiguring IAM policies which may open a backdoor for attackers. To address these challenges, first, we develop a novel framework that encodes generating optimal IAM policies using constraint programming (CP). We identify reducing dark permissions of cloud users as an optimality criterion, which intuitively implies minimizing unnecessary datastore access permissions. Second, to make IAM policies interpretable, we use graph representation learning applied to historical access patterns of users to augment our CP model with similarity constraints: similar users should be grouped together and share common IAM policies. Third, we describe multiple attack models and show that our optimized IAM policies significantly reduce the impact of security attacks using real data from 8 commercial organizations, and synthetic instances.","url_abs":"https://arxiv.org/abs/2205.01240v4","url_pdf":"https://arxiv.org/pdf/2205.01240v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"using-constraint-programming-and-graph","repo_url":"https://github.com/mikhail247/iamax","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":null}],"tasks":[{"task_slug":"graph-representation-learning","task_name":"Graph Representation Learning"},{"task_slug":"management","task_name":"Management"},{"task_slug":"representation-learning","task_name":"Representation Learning"}],"methods":[],"datasets_introduced":[{"slug":"identity-access-management-dataset","name":"Identity Access Management dataset","full_name":""}],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2205.01240","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2205.01240"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/mikhail247/IAMAX","reach":null}],"summary":{"ran_honours":3,"ran_draft_wrong":1,"unverified":4},"by_repo_kind":{"official":{"samples":8,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":8,"samples":[{"code_sha256_prefix":"f4d4140106b99f80","entry":"compute_avg_entity_dissimilarity","repo":"mikhail247/IAMAX","repo_kind":"official","path":"src/iam_optimization_cp.py","file_url":"https://github.com/mikhail247/IAMAX/blob/HEAD/src/iam_optimization_cp.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f4d4140106b99f80"}},{"code_sha256_prefix":"5360090c946489bd","entry":"find_max_n_distinct_entities","repo":"mikhail247/IAMAX","repo_kind":"official","path":"src/iam_optimization_cp.py","file_url":"https://github.com/mikhail247/IAMAX/blob/HEAD/src/iam_optimization_cp.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5360090c946489bd"}},{"code_sha256_prefix":"5d7c6c0390e324f4","entry":"get_max_group_diameter","repo":"mikhail247/IAMAX","repo_kind":"official","path":"src/iam_optimization_cp.py","file_url":"https://github.com/mikhail247/IAMAX/blob/HEAD/src/iam_optimization_cp.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5d7c6c0390e324f4"}},{"code_sha256_prefix":"d09e4697f86f3d4a","entry":"get_relative_dark_permissions_fraction","repo":"mikhail247/IAMAX","repo_kind":"official","path":"src/iam_optimization_cp.py","file_url":"https://github.com/mikhail247/IAMAX/blob/HEAD/src/iam_optimization_cp.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d09e4697f86f3d4a"}},{"code_sha256_prefix":"656404614d1b8c71","entry":"add_data_store_xor_constraint","repo":"mikhail247/IAMAX","repo_kind":"official","path":"src/iam_optimization_cp.py","file_url":"https://github.com/mikhail247/IAMAX/blob/HEAD/src/iam_optimization_cp.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"656404614d1b8c71"}},{"code_sha256_prefix":"04e78148a0a62a52","entry":"add_user_xor_constraint","repo":"mikhail247/IAMAX","repo_kind":"official","path":"src/iam_optimization_cp.py","file_url":"https://github.com/mikhail247/IAMAX/blob/HEAD/src/iam_optimization_cp.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"04e78148a0a62a52"}},{"code_sha256_prefix":"4dcef4faa092b9a8","entry":"compute_number_of_unsatisfied_constraints","repo":"mikhail247/IAMAX","repo_kind":"official","path":"src/iam_optimization_cp.py","file_url":"https://github.com/mikhail247/IAMAX/blob/HEAD/src/iam_optimization_cp.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4dcef4faa092b9a8"}},{"code_sha256_prefix":"adde8df688a11d8e","entry":"solve","repo":"mikhail247/IAMAX","repo_kind":"official","path":"src/iam_optimization_cp.py","file_url":"https://github.com/mikhail247/IAMAX/blob/HEAD/src/iam_optimization_cp.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"adde8df688a11d8e"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}