Identity and Access Management

- Root/global admin usage and MFA enforcement - IAM policies (overly permissive, wildcards, unused) - Role trust policies and cross-account access - Service accounts and access keys rotation