Cloud Identity: attacks and IAM hardening

Cloud Identity refers to the set of mechanisms that control authentication and authorization in cloud environments, covering IAM policies, federated identity providers, service accounts, and OAuth/OIDC token flows across AWS, Azure, and GCP. Unlike traditional on-premises Active Directory models, cloud identity is API-driven. Every resource access request is mediated by a control plane that evaluates identity tokens and attached policies. A misconfigured IAM role, an overly permissive service account, or a leaked OAuth token can grant an attacker lateral movement across an entire cloud tenant. The attack surface includes human identities — users, administrators — and non-human identities: CI/CD pipelines, Lambda functions, virtual machines using instance metadata service (IMDS), and managed identities. Cloud identity is particularly critical because the blast radius of a compromised identity is not bounded by network perimeters, making it a primary target in cloud-native intrusions.

Detecting cloud identity abuse requires centralized ingestion of control plane logs. On AWS, CloudTrail records every API call, including AssumeRole, GetCallerIdentity, and CreateAccessKey events. Unusual AssumeRole chains across accounts, or AssumeRoleWithWebIdentity calls from unexpected sources, are strong indicators of token abuse. On Azure, Entra ID Sign-in logs and Azure Monitor capture risky sign-ins, service principal authentications, and role assignments. Alert on AddMember to privileged roles, or on service principal logins from atypical geolocation or IP ranges. On GCP, Cloud Audit Logs track SetIamPolicy and GenerateAccessToken calls. SIEM correlation rules should flag short-lived token generation in rapid succession, cross-project service account impersonation, and permission enumeration patterns from tools such as ScoutSuite, Prowler, or Pacu. Behavioral baselines established via UEBA help surface dormant identity activations, which are often missed by static threshold rules.

Red team operators targeting cloud identity typically begin with credential harvesting — extracting access keys from public repositories, environment variables, or the IMDS endpoint at 169.254.169.254. Pacu and Stratus Red Team automate privilege escalation chains, such as iam:PassRole combined with lambda:CreateFunction to achieve silent privilege escalation without touching the original principal. In Azure, abusing Managed Identity tokens from a compromised virtual machine allows lateral movement to Key Vault or storage accounts. OAuth device code phishing is an increasingly common initial access vector, bypassing MFA entirely by tricking users into authorizing a malicious application. Hardening priorities include enforcing least-privilege IAM policies with AWS IAM Access Analyzer or Azure Policy, disabling unused service accounts, rotating access keys programmatically, enabling MFA for all human identities, restricting IMDS to IMDSv2 on AWS, and auditing OAuth application consent grants regularly to revoke excessive delegated permissions.