1. An access management system for managing permissions for applications deployed in a distributed computing infrastructure, the system comprising: an access management server having a processing device in communication with one or more coupled information storage systems; a distributed computing infrastructure having a plurality of resource instances and a request log, the distributed computing infrastructure being in communication with the access management system; an administration system having a security application executing thereon, the security application having a plurality of access policies associated with each of a plurality of applications; and wherein the processing device of the access management server: receives application request information from the request log, the application request information describing requests made by a first application of the plurality of applications being monitored by the access management server, receives an access policy describing a set of accessible APIs associated with the first application from the security application, determines that access to a first API of the set of accessible APIs associated the first application should be removed, and modifies the access policy to remove access to the first API of the set of accessible APIs associated with the first application.