Topic
Practice of designing cloud identity and access controls: role trust policies, permission boundaries, and break-glass paths across providers like AWS and OCI.
EKS Pod Identity, launched at re:Invent 2023, replaces IRSA's per-cluster OIDC trust with one pods.eks.amazonaws.com principal on every IAM role. A dev.to migration guide has each role trust both paths during cutover, so teams can move and verify one workload at a time.
Reality
In a dev.to write-up, Jorge RN traces the chain from a workload's own identity to an ephemeral OCI session token, where the authorization decision reads claims such as repository, workflow and branch.
Reality
New AWS sign-ups federate to a Google, GitHub or Apple login and arrive as a project whose resource permissions are set by the console and by whatever coding agent the owner pastes AWS's setup text into. The rollout covers new customers only.
Reality
Trust Boundary's walkthrough of the 2019 Capital One breach puts the weight on the IAM role attached to the firewall instance, and says the OCC consent order that followed does not mention server-side request forgery at all.
Reality
Google's Custom Search JSON API is closed to new customers and stops working on January 1, 2027. One builder replaced it with Amazon Bedrock AgentCore Web Search and paid a 40 percent premium to keep the tool under IAM.
Reality
Google's Threat Intelligence Group says a suspected financially motivated actor assembled the rig from an AI coding chatbot and preconfigured Markdown files, then ran it inside a compromised cloud tenant.
Reality
Unit 42 committed a fresh, overly permissive AWS key to a random GitHub repository with the usual quarantine policy switched off, then timed how long a cryptojacking crew took to find it and start mining.
Reality
Workload Identity Federation swaps a downloadable JSON key for three objects that all have to exist before anything works. An InfoQ practitioner reports 120-plus GCP projects on it in six months, and names the gate teams leave open.
Reality
epilot's monitoring caught an AI coding agent deploying straight into production. Nothing broke, and the company still moved all human production access behind a broker.
Reality