AWS
Monitor AWS IAM access and offboarding
Continuous visibility into the IAM users, roles, access keys, and accounts across your AWS Organization — including the privileged access nobody remembered to revoke.
Your AWS estate is where your infrastructure actually lives, and access to it accumulates faster than anyone reviews it. Engineers are granted IAM users for a one-off task, CI pipelines pick up long-lived access keys, and a role created for a migration two years ago still carries administrator privilege. Each grant made sense at the time. Together they become a blast radius nobody can describe from memory.
The default AWS experience makes this worse. IAM lives per-account, access keys are buried under each user, and the moment you adopt AWS Organizations the problem multiplies across every member account. To answer a simple question — who can administer this account, and should they? — you'd click through the IAM console account by account and still miss the access key that hasn't been rotated since the user left.
Outpost replaces that with a single, continuously-synced inventory. It reads your accounts through a read-only cross-account role — scoped to the AWS-managed SecurityAudit policy — and surfaces every IAM user, their keys and MFA status, every role and the policies attached to it, and the guardrails on each account. You can finally see your whole estate's access in one place and search it like the asset it is.
Catch AWS access that outlives employment
The most dangerous AWS access is the access that should already be gone. An engineer leaves, HR closes their accounts, but their IAM user — and the long-lived access key it carries — quietly survives. Service credentials are worse still: a key minted for a deploy isn't tied to any offboarding checklist at all.
Outpost is built around catching exactly this. Because it links each IAM user back to the person behind it, the moment someone is marked as departed, their lingering console access, attached policies, and active access keys surface for review. You don't have to remember that the contractor still has admin on the billing account — Outpost remembers for you.
That's the difference between hoping offboarding was complete and proving it. Outpost turns "who can still reach our AWS?" from a manual audit nobody has time for into a question you can answer continuously.
What Outpost detects
Everything we surface from your AWS workspace.
IAM users, access keys, and MFA
Outpost syncs every IAM user across your accounts with their access keys — including key age and last-used date — their console access, and whether MFA is enabled, so dormant credentials and unprotected logins surface.
Roles, policies, and privilege
Outpost maps IAM roles and the policies attached to users and roles, surfacing who — or which workload — can assume administrator-level privilege across your environment.
Accounts and root usage
For every account in your AWS Organization, Outpost tracks account-level guardrails and root-user activity, so the most powerful credentials in your estate don't go unwatched.
Assets we track
Outpost creates and maintains these asset types from your AWS data.
How it works
1
Connect
Grant Outpost a read-only cross-account IAM role — the AWS-managed SecurityAudit policy is enough. Outpost only ever reads; it never changes resources, policies, or data.
2
Discover
Outpost inventories your accounts, IAM users, roles, and access keys, and creates assets you can search, filter, and review in one place.
3
Monitor
Users, roles, key age, and policy attachments are re-synced continuously, so new admin grants and aging access keys are tracked over time.
4
Offboard
When an employee leaves, Outpost links their identity to the IAM users and keys they still hold, so lingering console access and active credentials surface instead of sitting unnoticed.
Frequently asked questions
Connect your AWS Organization to Outpost and it inventories every IAM user across your accounts with their roles, attached policies, access keys, and MFA status. Instead of auditing each account in the IAM console, you get one searchable view of who can reach what — including who holds administrator privilege.
Outpost continuously syncs your IAM users and links each one to the person behind it. When someone is offboarded, their lingering IAM user, console access, and active access keys are flagged for review, so admin rights and long-lived credentials don't outlive their employment.
Yes. Outpost tracks every access key with its age and last-used date, so keys that haven't been used in months — or were never rotated — surface for cleanup before they become a liability.
See your entire AWS footprint in one place
Join the waitlist for early access to Outpost's AWS integration and every other tool in your stack.