By 2018 World Fuel Services, a global fuel provider, had accumulated 22 data centers through business acquisitions, many of which were running legacy workloads. The company needed to consolidate its data centers to optimize costs and to deliver technology at the pace of a startup, so it set an audacious goal to migrate to the AWS public cloud and get out of the business of running data centers within 2 years.

To eliminate identity risks, this customer leveraged automatic analytics based on Sonrai Dig’s resource graph. The IAM data collected across all World Fuel Services AWS accounts and Azure subscriptions by Dig was compiled into a normalized graph data model that quickly surfaced complex IAM and data relationships across all cloud identities. Unlike many solutions that only show singular IAM relationships (e.g. a role with EC2FullAccess or an owner of a subscription), Sonrai Dig connected the dots to show all relationships in a single picture and uncovered hidden risks. Excessive privilege risks can be eliminated, and ‘least privilege’ enforced.

The impact of automation has been stunning. Sonrai Dig organized analysis, alerts, and actions for environments into approximately 40 “swimlanes” – automatically directing issues to the right World Fuel team owners or bot responsible for remediating. Dig gives each environment overall importance and a single pane of glass with the visual representation of security posture and risk. The right issues go to the right team, eliminating alert fatigue. Sonrai Dig helped the team improve inventory management of people and non-people identities, providing an end-to-end view to manage coverage for all of their dynamic cloud assets. The ability to filter and get immediate information for any instance or object in their environment was key. Dig now monitors the organization’s entire cloud (QA, development, and production) for any configuration or access drift.