IAM
Identity and access management
The policies, processes and systems that create, change and remove identities and decide what they can access; in a cloud platform, the IAM service evaluates every API call against identity and resource policies.
Covered in
Review cloud permissions and role trust together
Distinguish who can obtain a cloud identity from what that identity can do, then test the effective access path.
Review infrastructure changes as access changes
Inspect the effective permissions, exposure, sensitive state, and recovery implications of a proposed infrastructure change.
Apply a security baseline across AWS, Azure and Google Cloud
Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.
Contain a leaked secret, then investigate and clean up
Revoke an exposed API key, token or private key at its issuer before anything else, end the sessions it minted, check the provider's logs, then remove every copy and replace it with a credential that expires on its own.
Practice: IAM trust policy lab: Evaluate a role trust policy against the confused deputy