Identity and security

Identity work on this site is the IAM, federation and workload-identity model that grants access. It is not a general security-product review.

Who this topic is for

Identity owners and platform engineers who need a trust model that matches the provider they actually run, including a second cloud when one already exists.

Problems these pages cover

Human and workload identities share the same long-lived keys.
A second provider was added and SSO was copied rather than federated.
Break-glass paths are undocumented until someone is locked out.

Guides in this topic

Ankit Mehta Sep 23

What a Cross-Cloud Security Incident Changed in Our Kubernetes Rebuild

Identity and security

The response team found evidence that cloud identities and compute resources could no longer be trusted. The affected estate spanned AWS and Alibaba Cloud. Workloads were still running.

Ankit Mehta Updated Aug 30

Designing multi-cloud identity

Identity and security

The single-cloud baseline is IAM fundamentals. Whether a second cloud is justified at all is single cloud vs multi-cloud. AWS IAM Identity Center (used by Control Tower) maps IdP groups to permission sets, then to accounts in Organizations. Azure RBAC maps Entra groups to roles on management groups, subscriptions and resource groups.

Related runbooks

IAM access lockout

Consulting

Scoped review for this topic: Multi-cloud consulting.