{"id":199,"date":"2026-10-30T07:59:08","date_gmt":"2026-10-30T07:59:08","guid":{"rendered":"https:\/\/rezachegini.com\/?post_type=project&#038;p=199"},"modified":"2026-10-30T07:59:08","modified_gmt":"2026-10-30T07:59:08","slug":"multi-cloud-iam-least-privilege-framework","status":"publish","type":"project","link":"https:\/\/rezachegini.com\/?project=multi-cloud-iam-least-privilege-framework","title":{"rendered":"Multi-Cloud IAM Least Privilege Framework"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Built a production-grade IAM security framework across AWS, GCP, and Azure using Terraform. Implements least-privilege policies, credential-free Kubernetes workloads, and automated daily security auditing across all 3 clouds.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">AWS implementation:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IAM groups (dev, ops, readonly, admin) \u2014 policies attached to groups, never directly to users<\/li>\n\n\n\n<li>4 custom managed policies scoped to exact resources and prefixes<\/li>\n\n\n\n<li>5 IAM roles with MFA requirements on sensitive roles<\/li>\n\n\n\n<li>IRSA on EKS \u2014 pods access AWS via short-lived OIDC tokens, zero static credentials<\/li>\n\n\n\n<li>GitHub Actions CI\/CD role using OIDC federation \u2014 no static keys in secrets<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">GCP implementation:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>3 service accounts (app, cicd, monitoring) with separated responsibilities<\/li>\n\n\n\n<li>Custom role with only 4 permissions instead of primitive roles\/editor<\/li>\n\n\n\n<li>Workload Identity on GKE \u2014 K8s ServiceAccount annotated with GCP SA email<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Azure implementation:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>User-assigned Managed Identities for AKS workloads<\/li>\n\n\n\n<li>Custom RBAC roles scoped to specific resource types<\/li>\n\n\n\n<li>AKS Workload Identity with federated credentials<\/li>\n\n\n\n<li>Key Vault, Storage Account, ACR with least-privilege role assignments<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Audit automation:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Python scripts scan all 3 clouds for wildcard policies, missing MFA, unused roles, old access keys, exported GCP SA keys, and broad Azure Owner assignments<\/li>\n\n\n\n<li>Scripts exit with code 1 on HIGH findings \u2014 compatible with CI\/CD pipelines<\/li>\n\n\n\n<li>GitHub Actions daily cron job with OIDC auth across all 3 clouds<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Real findings: The audit scripts found 6 HIGH severity issues in my own accounts including wildcard policies auto-generated by AWS CodePipeline, a GCP default compute SA with roles\/editor, and users without MFA.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Built a production-grade IAM security framework across AWS, GCP, and Azure using Terraform. Implements least-privilege policies, credential-free Kubernetes workloads, and automated daily&hellip;<\/p>\n","protected":false},"featured_media":0,"menu_order":0,"template":"","tech":[136,141,145,150,144,143,149,137,148,120,146,147,135],"class_list":["post-199","project","type-project","status-publish","hentry","tech-amazon-eks","tech-aws-iam","tech-azure-key-vault","tech-azure-kubernetes-service-aks","tech-azure-rbac","tech-gcp-iam","tech-gcp-workload-identity","tech-github-actions","tech-irsa","tech-kubernetes","tech-openid-connect-oidc","tech-python","tech-terraform"],"_links":{"self":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/project\/199","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/project"}],"about":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/types\/project"}],"wp:attachment":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=199"}],"wp:term":[{"taxonomy":"tech","embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftech&post=199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}