Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “Federation”
27 publicationsRun AI coding agents in GitHub Actions without exposing secrets
Treat the agent job as an untrusted-input processor. Follow the outside text from the trigger that admits it to the credentials it can reach, then split reading from writing so a successful injection reaches nothing worth stealing.
AI systems · GitHub / Anthropic / Google / Microsoft · By Cloud Security DeskRespond to an exposed AWS access key beyond the quarantine policy
In a published test, AWS attached its quarantine policy 10 seconds after a key leaked, but the policy denies actions without ending access. This playbook covers what it leaves open, which credentials outlive the key, and the order of containment.
Detection & response · Amazon Web Services / GitHub / Google Cloud · By Cloud Security DeskTier Entra administrator roles by the control they can take
Microsoft's own password reset and sensitive action tables show which Entra roles can take over which accounts. Use them, plus the non-role paths, to set three tiers, assignment rules and the controls that keep lower tiers out.
Identity & access · Microsoft Entra / Microsoft Graph · By Cloud Security DeskKnow what service mesh mTLS proves about the caller
A mesh handshake proves that a peer held a key for a namespace and service account. It says nothing about the user or the operation, and permissive defaults, probes and waypoints open paths around it.
Workload security · Istio / Linkerd / Kubernetes / Google Cloud / Microsoft Azure / Amazon Web Services · By Cloud Security DeskFind the AWS global control planes in your recovery path
Thirteen AWS control planes run in us-east-1 or us-west-2, and ordinary calls from other Regions still reach them. Audit runbooks, SDK settings and the last exercise, then swap each dependency for a data-plane operation.
Resilience · Amazon Web Services · By Cloud Security DeskFind the Entra changes that Backup and Recovery cannot roll back
Microsoft Entra Backup and Recovery rolls listed properties back to a daily backup kept for seven days. Credentials, role assignments, owners and user consent stay in place, and an unscoped recovery can undo your own containment.
Resilience · Microsoft Entra / Microsoft Graph · By Cloud Security DeskGive a SaaS vendor an AWS role without creating a confused deputy
A vendor's cross-account role is safe only if your trust policy demands an exact external ID, the vendor's backend generates and enforces it per tenant, and your reviews catch drift and offboard the role.
Identity & access · Amazon Web Services · By Cloud Security DeskCompare just-in-time privileged access in AWS, Azure and Google Cloud
Entra PIM and Google Cloud PAM make roles temporary natively, while AWS relies on TEAM or partner tools. All three end elevation by removing an assignment, and sessions, caches and minted tokens can keep running.
Identity & access · Amazon Web Services / Microsoft Azure / Microsoft Entra / Google Cloud · By Cloud Security DeskRoll over a SAML signing certificate without an SSO outage
Replacing an identity provider's SAML signing key is a separate contract with every service provider. Classify each one by how it learns keys, overlap where it can hold two and finish by removing the old key everywhere.
Identity & access · Microsoft Entra / Okta / Google Workspace / Amazon Web Services · By Cloud Security DeskGive Kubernetes pods cloud credentials without static keys
EKS Pod Identity, IRSA, AKS Workload ID and Workload Identity Federation for GKE all swap a projected token for short-lived credentials. What leaks if you stop there is the node's own identity.
Identity & access · Amazon Web Services / Microsoft Azure / Google Cloud / Kubernetes · By Cloud Security DeskPrepare Azure automation for mandatory MFA on resource management
Azure now requires MFA for user accounts that write through Resource Manager. Find the scripts and pipelines that still sign in as people and move each one to a managed identity or federated credential.
Identity & access · Microsoft Azure / Microsoft Entra / GitHub / Azure DevOps / HashiCorp Terraform · By Cloud Security DeskLet AWS workloads call external services with IAM-issued tokens
IAM outbound identity federation lets an AWS role trade its credentials for a signed JWT instead of storing a vendor API key. AWS controls issuance; the receiving service's claim checks decide what the token is worth.
Identity & access · Amazon Web Services / AWS IAM / AWS STS / Microsoft Entra · By Cloud Security DeskBuild a cryptographic inventory for the post-quantum transition
Record where public-key cryptography protects long-lived data and which library, service or vendor must change it. Then rank entries by function and data lifetime, not by how many RSA keys a scanner found.
Workload security · NIST / CISA / Office of Management and Budget / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskDefend cloud admin accounts against help desk social engineering
Attackers who talk a help desk into resetting MFA inherit every cloud console behind single sign-on. Verify callers properly, shrink what a reset hands over, and alert on the events it leaves.
Detection & response · Microsoft Entra / Okta / Amazon Web Services / CISA / Mandiant · By Cloud Security DeskPrepare a cloud exit strategy that satisfies DORA
DORA requires a tested exit plan for every cloud service that supports a critical or important function. This guide turns that duty into dependency maps, measured data exports, staged tests and register entries that agree.
Resilience · European Commission / European Supervisory Authorities / European Central Bank / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskProtect and recover your AWS root account
Protect AWS root access with MFA, current recovery contacts, separate daily administration, and a clear plan for Organizations member accounts.
Identity & access · AWS · By Cloud Security DeskGive Google Cloud teams access through IAM groups
Give Google Cloud teams IAM access through owned groups, choose a sensible resource scope, and verify migration and removal with practical checks.
Identity & access · Google Cloud · By Cloud Security DeskCall Vertex AI from Cloud Run without a service account key
Use a Cloud Run service account and ADC to call Vertex AI, separate deployment and runtime permissions, and remove an obsolete prototype key.
AI systems · Google Cloud · By Cloud Security DeskBind OAuth tokens to the client that presents them
DPoP can make possession of an access token insufficient for use, provided the issuer, client and resource server implement the same proof and key-binding contract.
Identity & access · IETF / Google · By Cloud Security DeskWorkload federation across clouds needs separate trust decisions
Cross-cloud federation adds trust decisions, not a portable permission system. Map each credential and resource grant before moving a runtime workload.
Identity & access · AWS / Google Cloud / Microsoft Entra · By Cloud Security DeskEntra emergency access that survives normal sign-in failure
A second administrator account does not prove an independent recovery path. Test the credential, workstation, policy and alert dependencies together.
Identity & access · Microsoft Entra · By Cloud Security DeskMake secret rotation reach every running application
Secret managers, mounted files, application memory and connection pools can disagree about the active credential. Test each stage before calling rotation complete.
Workload security · Kubernetes / AWS / Azure / Google Cloud · By Cloud Security DeskRotate Entra application certificates with proof of adoption
A renewed certificate can exist in Key Vault while a running client still uses the old key. Define the evidence that makes application rotation complete.
Identity & access · Microsoft Entra / Azure Key Vault · By Cloud Security DeskShort SSH certificates still need explicit access boundaries
An SSH certificate supplies bounded identity claims. The issuer, server, client and incident operator still make separate access decisions.
Identity & access · OpenSSH · By Cloud Security Desk