Security /
Identity + Cloud
AuthN vs AuthZ
- Authentication answers who you are.
- Authorization answers what you can do after that, and a valid identity can still have way too much access.
Identities
- People are only part of it. Services, CI jobs, devices, workloads, and agents all have identities too.
- For each one: what does it actually need, and for how long?
Tokens
- Check issuer, audience, scope, and expiry first.
- Long-lived or overly broad tokens deserve extra attention.
Shared responsibility
- The provider secures the underlying cloud.
- We still own how the service is configured, who can access it, and what data we put there.
Control vs data plane
- Control plane: who can change the environment.
- Data plane: who or what can reach and use the actual service or data.
- Locking down one does not automatically lock down the other.
Red flags
- Shared credentials and wildcard permissions.
- Stale access and unnecessary admin.
- Service identities that quietly accumulated more access than they need.
- Public access and broad IAM.
- Secrets and outbound access.
- Logging, ownership, and how far one bad permission could reach.