Abstract: An online system determines security specification for cloud computing assets of a cloud computing platform. The system initializes a security specification and monitors execution of an application over a time interval to receive information describing application programming interface (API) invocations performed by the application. For each action performed by the API invocation, the system determines whether the security specification allows the actions performed by the API invocation with the cloud computing asset. The system modifies the security specification if necessary to allow the application to perform the particular action with the particular cloud computing asset. The system enforces security permissions for applications running on cloud computing platform based on the generated security specification.