Cloud Security

2 posts in this category.

Apr 16, 20268 min read

The Pipeline Has No Secret. It Still Has a Cloud Identity.

Replacing static deployment keys with OIDC removes a credential from the repository. It does not decide which workflow deserves the resulting cloud role — that decision lives in the trust policy, and one wildcard can turn an organisation into a deployment API.

#cloud-security#identity-security#access-control#attack-paths

Aug 14, 20259 min read

Cloud IAM Privilege Escalation: Every Permission Is Individually Fine. The Chain Is Not.

CSPM and least-privilege tools grade each IAM policy on its own, and on its own nearly every policy passes. Cloud privilege escalation is a path across roles, accounts, and trust — and a scanner that cannot see the path cannot flag the risk.

#cloud-security#identity-security#privilege-escalation#attack-paths