How to Secure Cloud Machine Identities
summary
Shows concrete fixes: stop long‑lived keys by disable service account key creation (GCP org policy) and use cloud‑managed identities or workload identity federation (GitHub OIDC → GCP/AWS roles) so CI jobs get per‑run identities; audit and rotate any remaining keys with Cloud Monitoring API and AWS credential reports; enforce least privilege using Policy Intelligence / custom roles, IAM Access Analyzer and repo‑kid or pmapper to find unused access; demonstrates Octa and default GCE editor pitfalls and gives Terraform snippets to block static creds and deny risky actions.
AI-written summary · about
chapters (9)
- 0:00Introduction to cloud machine identities
- 1:02Why machine identity security matters
- 3:50Avoid long-lived static credentials
- 5:56Alternatives to static credentials
- 9:10Auditing and rotating credentials
- 11:16Enforce least privilege permissions
- 16:14Limit user access to identities
- 19:22Summary of best practices
- 20:13Q&A and closing remarks
related talks
13mMaking cloud security more human
50mDestroying Long-Lived Cloud Credentials with Workload Identity Federation
28mYour journey to temporary credentials in the cloud
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords
34mZero trust CI/CD pipeline
12mIdentity and permissions concerns to watch out for
16mSecuring your Cloud infrastructure: a first baseline
39mAutomated Cloud Security