Cloud Security Grey Zone: Who Owns the Risk of Managed Identities? by Kat Traxler

### Cloud Security Grey Zone — Who Owns the Risk of Managed Identities This briefing compares how AWS, Google Cloud, and Microsoft Entra ID design and manage CSP-controlled non-human identities, describes three distinct threat models (AWS confused-deputy due to missing IAM condition keys; Google Cloud service-agents creating transitive access risks because they are controlled by the provider; and Microsoft’s service principal hijacking where admins could add credentials to first-party service principals), and recommends targeted mitigations such as auditing IAM condition keys, minimizing enabled services and monitoring in Google Cloud, and monitoring/ensuring appInstancePropertyLock protections in Entra ID.