$ kubectl describe project multi-cloud-iam-least-privilege-framework
Multi-Cloud IAM Least Privilege Framework
Built a production-grade IAM security framework across AWS, GCP, and Azure using Terraform. Implements least-privilege policies, credential-free Kubernetes workloads, and automated daily security auditing across all 3 clouds.
AWS implementation:
- IAM groups (dev, ops, readonly, admin) — policies attached to groups, never directly to users
- 4 custom managed policies scoped to exact resources and prefixes
- 5 IAM roles with MFA requirements on sensitive roles
- IRSA on EKS — pods access AWS via short-lived OIDC tokens, zero static credentials
- GitHub Actions CI/CD role using OIDC federation — no static keys in secrets
GCP implementation:
- 3 service accounts (app, cicd, monitoring) with separated responsibilities
- Custom role with only 4 permissions instead of primitive roles/editor
- Workload Identity on GKE — K8s ServiceAccount annotated with GCP SA email
Azure implementation:
- User-assigned Managed Identities for AKS workloads
- Custom RBAC roles scoped to specific resource types
- AKS Workload Identity with federated credentials
- Key Vault, Storage Account, ACR with least-privilege role assignments
Audit automation:
- Python scripts scan all 3 clouds for wildcard policies, missing MFA, unused roles, old access keys, exported GCP SA keys, and broad Azure Owner assignments
- Scripts exit with code 1 on HIGH findings — compatible with CI/CD pipelines
- GitHub Actions daily cron job with OIDC auth across all 3 clouds
Real findings: The audit scripts found 6 HIGH severity issues in my own accounts including wildcard policies auto-generated by AWS CodePipeline, a GCP default compute SA with roles/editor, and users without MFA.