{"$schema":"https://iamscope.cloud/api/v1/schema/changes.json","contract":"public-v1","resource":"changes","description":"Eventos de mudança no catálogo de IAM das seis nuvens, derivados de snapshots diários.","generatedAt":"2026-08-28T01:06:45.080Z","license":{"id":"CC-BY-4.0","url":"https://creativecommons.org/licenses/by/4.0/","attribution":"IAM Scope — https://iamscope.cloud","note":"A licença cobre a CURADORIA (tier, category, isPrivileged, eamLevel, regras de SoD, equivalências, richDescription e a seleção/estrutura do conjunto). O fato bruto dos provedores não é relicenciado aqui e segue os termos de Microsoft, AWS, Google e IBM."},"sources":[{"id":"entraops","label":"AzurePrivilegedIAM / EntraOps — Thomas Naunheim","url":"https://github.com/Cloud-Architekt/AzurePrivilegedIAM","license":"MIT","covers":["entraid.roles.eamTier"]},{"id":"microsoft-info","label":"merill/microsoft-info — inventário do service principal do Microsoft Graph","url":"https://github.com/merill/microsoft-info","license":"MIT","covers":["entraid.apiPermissions"]},{"id":"microsoft-learn","label":"Microsoft Learn — Entra ID e Azure RBAC","url":"https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference","license":"Termos da Microsoft","covers":["entraid.roles","azure-rbac.roles","azure-rbac.actions"]},{"id":"aws-managed-policy-reference","label":"AWS Managed Policy Reference","url":"https://docs.aws.amazon.com/aws-managed-policy/latest/reference/policy-list.html","license":"Termos da AWS","covers":["aws.policies"]},{"id":"google-cloud-iam","label":"Google Cloud IAM — Roles and permissions","url":"https://docs.cloud.google.com/iam/docs/roles-permissions","license":"Termos do Google","covers":["gcp.roles","gcp.permissions"]},{"id":"google-workspace-admin-help","label":"Google Workspace Admin Help — Prebuilt administrator roles","url":"https://support.google.com/a/answer/2405986","license":"Termos do Google","covers":["google-workspace.roles","google-workspace.privileges"]},{"id":"ibm-cloud-docs","label":"IBM Cloud Docs — IAM roles e Managing classic infrastructure access","url":"https://cloud.ibm.com/docs/iam?topic=iam-userroles","license":"Termos da IBM","covers":["ibm-cloud.roles","ibm-cloud.classic-permissions"]}],"classification":{"value":"iamscope-editorial","fields":["type","tierFrom","tierTo","categoryFrom","categoryTo","privileged","sodAdded","sodRemoved"],"note":"Os campos listados são classificação editorial do IAM Scope, derivada das permissões oficiais de cada role. Não são classificação do provedor. Os demais campos são fato literal da fonte oficial identificada em `sources`."},"meta":{"historyStartsAt":"2026-06-30","firstObservedAt":"2026-08-24","clouds":{"entraid":{"snapshots":1,"first":"2026-08-24","derived":1},"azure-rbac":{"snapshots":1,"first":"2026-08-24","derived":1},"aws":{"snapshots":1,"first":"2026-08-24","derived":1},"gcp":{"snapshots":1,"first":"2026-08-24","derived":1},"google-workspace":{"snapshots":1,"first":"2026-08-24","derived":1},"ibm-cloud":{"snapshots":1,"first":"2026-08-24","derived":1}},"counts":{"total":17,"derived":6,"attested":11,"byType":{"created":0,"removed":0,"renamed":0,"description-changed":0,"permissions-changed":0,"tier-changed":0,"category-changed":0,"privilege-changed":0,"sod-changed":0,"genesis":6,"coverage-changed":0,"unknown":0,"dataset-recollected":6,"dataset-corrected":5}},"quarantineOpen":0,"disclosure":{"pt":"O histórico começa no dia em que a captura de snapshots foi ligada. Mudanças anteriores a essa data não foram observadas por nós: os eventos marcados como \"atestado\" vêm de registros datados do próprio repositório, não de comparação de estado. Não há como recuperar retroativamente o que não foi capturado — o que este changelog tem de diferente não é profundidade, é largura: seis nuvens, não uma.","en":"The history starts on the day snapshot capture was switched on. Changes before that date were not observed by us: events marked \"attested\" come from dated records in the repository itself, not from comparing two states. What was not captured cannot be recovered retroactively — what makes this changelog different is not depth, it is breadth: six clouds, not one."},"typeLabels":{"created":"criada","removed":"removida","renamed":"renomeada","description-changed":"descrição alterada","permissions-changed":"permissões alteradas","tier-changed":"mudou de tier","category-changed":"mudou de categoria","privilege-changed":"mudou de privilégio","sod-changed":"regra de SoD","genesis":"início do histórico","coverage-changed":"cobertura da coleta","unknown":"desconhecido","dataset-recollected":"dataset recoletado","dataset-corrected":"correção de dado"},"typeLabelsEn":{"created":"created","removed":"removed","renamed":"renamed","description-changed":"description changed","permissions-changed":"permissions changed","tier-changed":"tier changed","category-changed":"category changed","privilege-changed":"privilege changed","sod-changed":"SoD rule","genesis":"history starts","coverage-changed":"collection coverage","unknown":"unknown","dataset-recollected":"dataset re-collected","dataset-corrected":"data correction"},"cloudLabels":{"entraid":"Entra ID","azure-rbac":"Azure RBAC","aws":"AWS IAM","gcp":"GCP IAM","google-workspace":"Google Workspace","ibm-cloud":"IBM Cloud"},"feeds":{"all":"https://iamscope.cloud/feeds/all.xml","entraid":"https://iamscope.cloud/feeds/entraid.xml","entraid-privileged":"https://iamscope.cloud/feeds/entraid-privileged.xml","azure-rbac":"https://iamscope.cloud/feeds/azure-rbac.xml","azure-rbac-privileged":"https://iamscope.cloud/feeds/azure-rbac-privileged.xml","aws":"https://iamscope.cloud/feeds/aws.xml","aws-privileged":"https://iamscope.cloud/feeds/aws-privileged.xml","gcp":"https://iamscope.cloud/feeds/gcp.xml","gcp-privileged":"https://iamscope.cloud/feeds/gcp-privileged.xml","google-workspace":"https://iamscope.cloud/feeds/google-workspace.xml","google-workspace-privileged":"https://iamscope.cloud/feeds/google-workspace-privileged.xml","ibm-cloud":"https://iamscope.cloud/feeds/ibm-cloud.xml","ibm-cloud-privileged":"https://iamscope.cloud/feeds/ibm-cloud-privileged.xml"}},"changes":[{"date":"2026-08-24","cloud":"aws","collection":"_","collectionLabel":"AWS IAM","type":"genesis","itemId":null,"itemName":"AWS IAM","counts":{"policies":1582,"actions":16423},"summary":{"pt":"O histórico de AWS IAM começa aqui, com 1.582 Managed Policies e 16.423 IAM Actions. Mudanças anteriores a esta data não foram observadas por nós e não estão listadas.","en":"The history of AWS IAM starts here, with 1,582 Managed Policies and 16,423 IAM Actions. Changes before this date were not observed by us and are not listed."},"origin":"derived","classification":"iamscope-process","id":"aws:_:_:2026-08-24:genesis"},{"date":"2026-08-24","cloud":"azure-rbac","collection":"_","collectionLabel":"Azure RBAC","type":"genesis","itemId":null,"itemName":"Azure RBAC","counts":{"roles":504,"actions":17605},"summary":{"pt":"O histórico de Azure RBAC começa aqui, com 504 Built-in Roles e 17.605 Resource Provider Actions. Mudanças anteriores a esta data não foram observadas por nós e não estão listadas.","en":"The history of Azure RBAC starts here, with 504 Built-in Roles and 17,605 Resource Provider Actions. Changes before this date were not observed by us and are not listed."},"origin":"derived","classification":"iamscope-process","id":"azure-rbac:_:_:2026-08-24:genesis"},{"date":"2026-08-24","cloud":"entraid","collection":"_","collectionLabel":"Entra ID","type":"genesis","itemId":null,"itemName":"Entra ID","counts":{"roles":144,"api-permissions":1504},"summary":{"pt":"O histórico de Entra ID começa aqui, com 144 Directory Roles e 1.504 Microsoft Graph API Permissions. Mudanças anteriores a esta data não foram observadas por nós e não estão listadas.","en":"The history of Entra ID starts here, with 144 Directory Roles and 1,504 Microsoft Graph API Permissions. Changes before this date were not observed by us and are not listed."},"origin":"derived","classification":"iamscope-process","id":"entraid:_:_:2026-08-24:genesis"},{"date":"2026-08-24","cloud":"gcp","collection":"_","collectionLabel":"GCP IAM","type":"genesis","itemId":null,"itemName":"GCP IAM","counts":{"roles":2389,"permissions":13701},"summary":{"pt":"O histórico de GCP IAM começa aqui, com 2.389 Predefined Roles e 13.701 IAM Permissions. Mudanças anteriores a esta data não foram observadas por nós e não estão listadas.","en":"The history of GCP IAM starts here, with 2,389 Predefined Roles and 13,701 IAM Permissions. Changes before this date were not observed by us and are not listed."},"origin":"derived","classification":"iamscope-process","id":"gcp:_:_:2026-08-24:genesis"},{"date":"2026-08-24","cloud":"google-workspace","collection":"_","collectionLabel":"Google Workspace","type":"genesis","itemId":null,"itemName":"Google Workspace","counts":{"roles":14,"privileges":120},"summary":{"pt":"O histórico de Google Workspace começa aqui, com 14 Admin Roles e 120 Admin Privileges. Mudanças anteriores a esta data não foram observadas por nós e não estão listadas.","en":"The history of Google Workspace starts here, with 14 Admin Roles and 120 Admin Privileges. Changes before this date were not observed by us and are not listed."},"origin":"derived","classification":"iamscope-process","id":"google-workspace:_:_:2026-08-24:genesis"},{"date":"2026-08-24","cloud":"ibm-cloud","collection":"_","collectionLabel":"IBM Cloud","type":"genesis","itemId":null,"itemName":"IBM Cloud","counts":{"roles":7,"classic-permissions":71},"summary":{"pt":"O histórico de IBM Cloud começa aqui, com 7 Platform and Service Roles e 71 Classic Infrastructure Permissions. Mudanças anteriores a esta data não foram observadas por nós e não estão listadas.","en":"The history of IBM Cloud starts here, with 7 Platform and Service Roles and 71 Classic Infrastructure Permissions. Changes before this date were not observed by us and are not listed."},"origin":"derived","classification":"iamscope-process","id":"ibm-cloud:_:_:2026-08-24:genesis"},{"date":"2026-08-23","cloud":"azure-rbac","collection":"roles","collectionLabel":"Built-in Roles","type":"dataset-corrected","itemId":"permissoes-efetivas","itemName":"Permissões efetivas (wildcards expandidos)","summary":{"pt":"`permissionCount` conta entradas da definição, não permissões concedidas: owner.json é uma linha só (`\"*\"`), então Owner, Contributor e Reader apareciam com 1 permissão, empatadas com a AcrPull. 56 das 504 roles marcavam 1, e o máximo do dataset era 103 — qualquer ordenação por \"menor privilégio\" estava invertida. build-effective-perms.js passou a emitir `effectiveActions` AO LADO, sem substituir o número nativo da Microsoft. Com wildcards expandidos, a Owner concede 17.591 ações.","en":"`permissionCount` counts definition entries, not granted permissions: owner.json is a single line (`\"*\"`), so Owner, Contributor and Reader showed 1 permission, tied with AcrPull. 56 of the 504 roles showed 1, and the dataset maximum was 103 — any \"least privilege\" ordering was inverted. build-effective-perms.js now emits `effectiveActions` ALONGSIDE, without replacing Microsoft's native number. With wildcards expanded, Owner grants 17,591 actions."},"source":{"label":"scripts/build-effective-perms.js","path":"scripts/build-effective-perms.js"},"origin":"attested","classification":"iamscope-editorial","id":"azure-rbac:roles:permissoes-efetivas:2026-08-23:dataset-corrected"},{"date":"2026-08-21","cloud":"aws","collection":"policies","collectionLabel":"Managed Policies","type":"dataset-corrected","itemId":"effect-deny","itemName":"Parser de Effect nas policies","summary":{"pt":"O parser passou a respeitar o `Effect` de cada statement: actions em statements `Deny` não contam mais como concessão. Corrigiu 42 policies — inclusive a AWSDenyAll, que aparecia com tier Full Access por ter o universo inteiro num Deny.","en":"The parser now respects the `Effect` of each statement: actions inside `Deny` statements no longer count as a grant. This corrected 42 policies — including AWSDenyAll, which showed up as Full Access tier because it had the whole universe inside a Deny."},"source":{"label":"src/data/syncMeta.ts — aws-policies","path":"src/data/syncMeta.ts"},"origin":"attested","classification":"iamscope-editorial","id":"aws:policies:effect-deny:2026-08-21:dataset-corrected"},{"date":"2026-08-05","cloud":"ibm-cloud","collection":"classic-permissions","collectionLabel":"Permissões da infraestrutura clássica","type":"dataset-recollected","itemId":"71-permissoes-classicas","itemName":"Permissões da infraestrutura clássica","summary":{"pt":"Lacuna do clássico fechada com 71 permissões verbatim da IBM. Os docs de IAM saíram do repo ibm-cloud-docs/account e passaram a viver em ibm-cloud-docs/iam, onde iam-mnginfra.md publica as seis tabelas. As categorias passaram de quatro declaradas por nós — Account, Devices, Network, Services — para as seis reais: Administrative, Devices, Network, Sales, Security e Software.","en":"The classic-infrastructure gap closed with 71 verbatim IBM permissions. The IAM docs moved out of the ibm-cloud-docs/account repo and now live in ibm-cloud-docs/iam, where iam-mnginfra.md publishes the six permission tables. Categories went from four declared by us — Account, Devices, Network, Services — to the six real ones: Administrative, Devices, Network, Sales, Security and Software."},"source":{"label":"src/data/syncMeta.ts — ibm-roles","path":"src/data/syncMeta.ts"},"origin":"attested","classification":"iamscope-editorial","id":"ibm-cloud:classic-permissions:71-permissoes-classicas:2026-08-05:dataset-recollected"},{"date":"2026-08-05","cloud":"ibm-cloud","collection":"roles","collectionLabel":"Platform e Service Roles","type":"dataset-corrected","itemId":"157-para-7","itemName":"Modelo de acesso da IBM Cloud","summary":{"pt":"De 157 \"roles\" e 619 \"actions\" para 7 roles de IAM (4 de plataforma, 3 de serviço). Das 619 actions, 502 eram prosa em português escrita por nós — nas 83 roles clássicas, 243 de 243. O modelo real da IBM não tem role na infraestrutura clássica: tem permissão individual.","en":"From 157 \"roles\" and 619 \"actions\" to 7 IAM roles (4 platform, 3 service). Of the 619 actions, 502 were Portuguese prose written by us — in the 83 classic roles, 243 out of 243. IBM's real model has no roles in classic infrastructure: it has individual permissions."},"source":{"label":"src/data/syncMeta.ts — ibm-roles","path":"src/data/syncMeta.ts"},"origin":"attested","classification":"iamscope-editorial","id":"ibm-cloud:roles:157-para-7:2026-08-05:dataset-corrected"},{"date":"2026-08-04","cloud":"entraid","collection":"api-permissions","collectionLabel":"API Permissions do Microsoft Graph","type":"dataset-recollected","itemId":"854-para-1504","itemName":"API permissions do Microsoft Graph","summary":{"pt":"De 854 para 1.504 permissões. O dataset anterior tinha 692 das 707 Application e só 162 dos 797 escopos delegados, porque a coleta de 30/06 parseava a permissions-reference.md em vez de ler o inventário do service principal. Faltavam famílias inteiras de ControlPlane em delegated: Policy (29), RoleManagement (9), PrivilegedAccess (6). As 854 antigas foram preservadas verbatim — 0 órfãos, 0 IDs divergentes.","en":"From 854 to 1,504 permissions. The previous dataset had 692 of the 707 Application permissions and only 162 of the 797 delegated scopes, because the 30/06 collection parsed permissions-reference.md instead of reading the service principal inventory. Whole ControlPlane families were missing from delegated: Policy (29), RoleManagement (9), PrivilegedAccess (6). The old 854 were preserved verbatim — 0 orphans, 0 diverging IDs."},"source":{"label":"docs/AUDITORIA-api-permissions-2026-08-04.md","path":"docs/AUDITORIA-api-permissions-2026-08-04.md"},"origin":"attested","classification":"iamscope-editorial","id":"entraid:api-permissions:854-para-1504:2026-08-04:dataset-recollected"},{"date":"2026-08-03","cloud":"azure-rbac","collection":"actions","collectionLabel":"Resource Provider Actions","type":"dataset-recollected","itemId":"descricoes-de-action","itemName":"Descrições das actions","summary":{"pt":"Descrição oficial em 95,2% das 1.947 actions concretas referenciadas por roles. As outras 750 do índice são wildcards (Microsoft.Foo/*), que são padrão de correspondência e não operação — a Microsoft não as documenta, e por isso ficam fora do denominador em vez de contarem como lacuna.","en":"Official description for 95.2% of the 1,947 concrete actions referenced by roles. The other 750 in the index are wildcards (Microsoft.Foo/*), which are match patterns rather than operations — Microsoft does not document them, so they stay out of the denominator instead of counting as a gap."},"source":{"label":"src/data/syncMeta.ts — azure-rbac-actions","path":"src/data/syncMeta.ts"},"origin":"attested","classification":"iamscope-editorial","id":"azure-rbac:actions:descricoes-de-action:2026-08-03:dataset-recollected"},{"date":"2026-08-03","cloud":"google-workspace","collection":"roles","collectionLabel":"Admin Roles","type":"dataset-corrected","itemId":"44-para-14","itemName":"Prebuilt admin roles","summary":{"pt":"De 44 roles para 14. Das 44 anteriores, 30 não constavam da documentação do Google, e 79 dos 84 nomes de privilégio não existiam na API. Tudo substituído pelo catálogo oficial. O mapa role→privilegeName só é publicado para 2 das 14 roles; para as demais exige OAuth no tenant e ficou declarado como lacuna, em vez de preenchido por inferência.","en":"From 44 roles to 14. Of the previous 44, 30 did not appear in Google's documentation, and 79 of 84 privilege names did not exist in the API. All replaced with the official catalogue. The role→privilegeName map is published for only 2 of the 14 roles; for the rest it requires OAuth in the tenant and was declared a gap rather than filled by inference."},"source":{"label":"src/data/syncMeta.ts — gws-roles","path":"src/data/syncMeta.ts"},"origin":"attested","classification":"iamscope-editorial","id":"google-workspace:roles:44-para-14:2026-08-03:dataset-corrected"},{"date":"2026-07-31","cloud":"azure-rbac","collection":"roles","collectionLabel":"Built-in Roles","type":"dataset-recollected","itemId":"recontagem-504","itemName":"Recontagem das built-in roles","summary":{"pt":"504 confirmado como o número oficial: 504 blocos \"roleName\" e 504 GUIDs únicos nos 19 arquivos built-in-roles/*.md da Microsoft. O critério do catálogo é o que a documentação descreve hoje — role descontinuada, que já saiu de lá, não entra na conta.","en":"504 confirmed as the official number: 504 \"roleName\" blocks and 504 unique GUIDs across Microsoft's 19 built-in-roles/*.md files. The catalogue's criterion is what the documentation describes today — a discontinued role, already gone from there, does not count."},"source":{"label":"src/data/syncMeta.ts — azure-rbac-roles","path":"src/data/syncMeta.ts"},"origin":"attested","classification":"iamscope-editorial","id":"azure-rbac:roles:recontagem-504:2026-07-31:dataset-recollected"},{"date":"2026-07-31","cloud":"gcp","collection":"roles","collectionLabel":"Predefined Roles","type":"dataset-recollected","itemId":"232-para-2389","itemName":"Predefined roles do GCP","summary":{"pt":"De 232 roles com 6% de cobertura de permissões para 2.389 roles com as listas completas. Coletado das páginas públicas por serviço, sem credencial: a IAM API responde 403 sem autenticação, mas as páginas da documentação são renderizadas no servidor.","en":"From 232 roles with 6% permission coverage to 2,389 roles with complete lists. Collected from the public per-service pages, without credentials: the IAM API returns 403 unauthenticated, but the documentation pages are server-rendered."},"source":{"label":"src/data/syncMeta.ts — gcp-roles","path":"src/data/syncMeta.ts"},"origin":"attested","classification":"iamscope-editorial","id":"gcp:roles:232-para-2389:2026-07-31:dataset-recollected"},{"date":"2026-07-29","cloud":"aws","collection":"policies","collectionLabel":"Managed Policies","type":"dataset-corrected","itemId":"descricoes-oficiais","itemName":"Descrições das managed policies","summary":{"pt":"Até 29/07 o campo `description` continha o template inventado \"<Nome> — AWS managed policy\" em 100% das policies. Substituído pelo texto literal da referência oficial da AWS. Era dado nosso apresentado como se fosse da AWS — o pior tipo de erro num site de referência.","en":"Until 29/07 the `description` field held the invented template \"<Name> — AWS managed policy\" for 100% of policies. Replaced with the literal text from the official AWS reference. It was our own text presented as if it came from AWS — the worst kind of error on a reference site."},"source":{"label":"src/data/aws.ts — comentário do campo description","path":"src/data/aws.ts"},"origin":"attested","classification":"iamscope-editorial","id":"aws:policies:descricoes-oficiais:2026-07-29:dataset-corrected"},{"date":"2026-06-30","cloud":"entraid","collection":"roles","collectionLabel":"Directory Roles","type":"dataset-recollected","itemId":"baseline-2026-06-30","itemName":"Baseline de verificação","summary":{"pt":"Primeira verificação registrada dos datasets contra as fontes oficiais. Antes desta data não havia rastreamento de versão ou commit por fonte. As 144 directory roles foram conferidas linha a linha contra a tabela do Microsoft Learn: 1 rename e 1 correção de grafia aplicados.","en":"First recorded verification of the datasets against their official sources. Before this date there was no per-source version or commit tracking. The 144 directory roles were checked line by line against the Microsoft Learn table: 1 rename and 1 spelling fix applied."},"source":{"label":"src/data/syncMeta.ts — entra-directory-roles","path":"src/data/syncMeta.ts"},"origin":"attested","classification":"iamscope-editorial","id":"entraid:roles:baseline-2026-06-30:2026-06-30:dataset-recollected"}]}