A year-long academic project, built with two teammates - not a company, though the shape of it could support real usage.

Identity and policy drift apart constantly in a real AWS account, and the two places you'd normally check - IAM policy, and what's actually allowed - rarely agree on their own. Getting that resolution wrong means either missing a real over-permission, or flagging one that isn't real.

A team of three, and I covered the most ground across it: UX/UI, the frontend, the API server, and part of the MCP server - the parts of the system a user or an LLM client actually touches, all reading from the same MongoDB.

My teammates owned the rest: managing our AWS test environment, the crawlers that pull live data from AWS into Redis, and the logic service that reads Redis and writes verdicts back to MongoDB.

Aura Cloud resolves something narrower and harder to get right than a resource map: which policies actually apply to a given identity, and whether AWS would allow or deny a specific action once those policies, and the account's cross-account rules, are all applied together.

IAM's own evaluation logic isn't simple. An explicit deny always wins, an unmatched action is denied by default, actions and resources can match on wildcards, and the same-account rule - identity or resource allows it - is not the cross-account rule, where both have to. Reproducing that correctly, not approximately, was the actual work.

Built end to end over a full academic year: six live crawlers pulling real AWS data through the AWS SDK, a logic service resolving IAM's evaluation rules correctly, a dashboard, and an MCP server exposing the same evaluator to an LLM client.

Done developing. The initial architecture held without a rework from the first version through to now - the one real cost it carries is covered below.

Extend coverage to more AWS resource types beyond what's there now - identity-to-policy resolution is solid, and the natural next step is breadth, not a rebuild.

The one real cost in the current design is the extra indirection every permission lookup pays for keeping login and AWS identity separate - worth watching if this ever became a real product rather than a project.