Cloud Infrastructure · Cluster
Identity and Access
Roles, policies, and least privilege.
- 01 Deny Wins: How One Request Is Evaluated Against Many Policy Documents The order in which identity policies, resource policies, boundaries, and organization policies combine to produce a single allow or deny, and why that order is not additive.
- 02 Role Assumption and the Shape of a Temporary Session How a caller exchanges long-lived identity for short-lived credentials, what the issued token actually carries, and why revocation is harder than expiry.
- 03 Wildcard Semantics in Resource ARNs and Why They Span Separators How the star and question-mark metacharacters match against ARN strings, where their reach exceeds the intent of the author, and how policy variables substitute before matching.
- 04 Trust Policies, External IDs, and the Confused Deputy Why a trust policy naming a principal is not enough when that principal acts for many customers, and how a shared secret in the assumption request closes the gap.
- 05 Permission Boundaries and Service Control Policies as Independent Ceilings How two documents that grant nothing restrict what other documents grant, what each one cannot cap, and how their scopes differ by blast radius.
- 06 Attribute Conditions: Constraining Access by Tag Instead of by Name How principal tags and resource tags become condition keys, why the two-sided check needs both halves, and what happens when a tag is missing or renamed.
- 07 The Instance Credential Chain and What the Metadata Service Exposes How a virtual machine obtains role credentials without a stored secret, why network reachability becomes identity, and how the request-side defences work.
- 08 Deriving Least Privilege from Recorded Access Instead of from Intent Why an audit trail is an incomplete oracle for permissions, how to turn call history into a candidate policy, and what such a policy systematically omits.
- 09 Federating Workloads with OIDC: Which Claims a Trust Policy Must Pin How a workload proves its identity with a signed token instead of a secret, why audience and subject both need pinning, and where claim matching goes wrong.
- 10 Deciding Whether a Policy Set Grants More Than Intended How an access policy becomes a logical formula, what an SMT solver can answer about it, and why the answer is only as good as the model of the request.