An open-source project called MII (Machine Identity Intelligence) is released to address what the author describes as a lack of visibility into “machine identities” in cloud environments—such as IAM roles, OIDC federations, and CI/CD tokens used to access AWS. The project’s motivation cites CyberArk’s 2025 Machine Identity Security Report, which it says finds machine identities outnumber human identities 82:1. The author argues that these identities often become a major attack vector and are frequently overlooked because security teams lack centralized visibility, ongoing monitoring, and clear answers about the consequences if an identity is compromised.
MII connects to AWS accounts in read-only mode to discover IAM roles, trust policies, attached permissions, and OIDC federations, then builds a directed “trust graph” showing who can assume what. It assigns each machine identity a 0–100 risk score using factors such as admin permissions, production access, cross-account trust, and staleness. It can also simulate compromise “blast paths” by tracing reachable identities and resources through the trust graph. The tool measures “trust debt,” runs automated IAM/OIDC policy checks aligned to best practices, and can generate remediation guidance with commands and Terraform snippets. The project supports AWS and includes GitLab CI/CD discovery, with additional roadmap items.
