Roles & licensing · IAM Cost Optimizer
Role carries more risk than an equivalent role granting the same apps
- Default severity
- Major
- Finding code:
- IAM_ROLE_RISK_ELEVATED
- Engine version:
- 1.2.0
What this finding means
IAM Cost Optimizer reports this finding with the default severity “Major”.
About the engine: Fiori catalog over-licensing & authorization license tier minimizer
How to fix it
Assign the lower-risk equivalent role instead, or remove the additional critical authorizations / emergency flag from this role - both roles grant the same apps.
How ERP Preflight detects it
The analysis is deterministic: the same exported files and the same knowledge snapshot always produce the same findings. No SAP system connection is required — you upload exports.
- Engine
- IAM Cost Optimizer
- Accepted formats
- JSON, CSV
- What to export
Role composition and assignments: JSON {'roles': [{role_name, catalogs, authorizations, assigned_users}], 'users': [...], 'catalogs': [...], 'price_categories': {...}, 'usage_records': [...], 'read_only_alternatives': {app_id: read_only_app_id}} or CSV exports AGR_USERS (UNAME, AGR_NAME), AGR_1251 (AGR_NAME, OBJECT, FIELD, LOW), catalog/app, ST03N usage and read-only alternatives (APP_ID, READ_ONLY_APP_ID).
- Required input
- business roles or user role assignments
- Evidence
- Each finding points to the artifact path, line and column, the code snippet and the SHA-256 of the uploaded file. Findings without such a pointer are demoted to confidence UNKNOWN.
- Confidence
- At most RULE_DERIVED (0.85): the verdict rests on Critical authorization objects, a curated catalog that is not verified against an official source.
- Knowledge sources
- Critical authorization objects — curated, not verified against the source
- Target releases of the engine
- S4H_2022, S4H_2023, S4HANA_CLOUD_2402, S4HANA_CLOUD_2408
Related findings
- MajorCritical authorization never used
- MinorChange app never used although a read-only alternative exists
- CriticalEmergency role assigned without end date
- MajorSingle app raises the role's license tier
- MajorCatalog fully contained in another catalog of the role
- MinorSmaller catalog composition covers all used apps
Terms used on this page
Background reading
- Troubleshooting HTTP 403 Forbidden in SAP Fiori appsThe usual causes of a 403 error when a Fiori app loads or calls its OData service — missing service authorizations, incomplete roles, inactive ICF services — and a systematic way to find the one that applies.