This is only a personal suggestion for anyone facing a similar issue. I was trying to understand which access risks were genuinely important because simply having a large list of warnings was not very useful. I researched cloud risk management platform, cloud IAM risk management, and cloud access risk management, and this helped me understand where the main risks were: https://teriam.io/cloud-computing-risk-management/ For me, the useful part was being able to connect the risk back to actual permissions and identities instead of looking at isolated alerts.