Catching Data Perimeter Drift Before It Reaches Production

Cloud providers provide tools for customers to prevent data exfiltration attempts by creating a data perimeter — a set of permission guardrails that ensure that only trusted identities from expected networks can access trusted resources [1]. For example, a company can set up controls so that users within its organization can access only their company-specific S3 buckets from their corporate networks. Any other access patterns will be denied.