Your cloud perimeter is an identity

Network controls matter, but a workload identity can reach resources far beyond its local network boundary. Review what a workload can do and who can assume its identity as separate questions.

Start with one workload

Pick a service you understand. List its runtime identity, the resources it needs, and the operations it performs. Include deployment jobs and recovery paths; permissions used only during an incident are still permissions.

Keep this inventory small enough to verify with the service owner. A broad spreadsheet that nobody maintains is less useful than one accurate service map.

Read the trust relationship

Ask which principals can assume the identity. Check conditions that bind access to the intended repository, environment, tenant, or workload. An overly broad trust relationship can undo a carefully scoped permissions policy.

For federated CI, validate the expected issuer, audience, and subject. Avoid accepting every branch or repository simply because it belongs to the same organization.

Compare intent with evidence

Review audit events over a representative period. A permission that is unused in a short sample may still be needed for a monthly job or recovery procedure. Combine observed use with the service’s documented responsibilities.

{
  "workload": "example-report-generator",
  "needs": ["read approved input", "write report output"],
  "review": ["trust conditions", "resource scope", "credential lifetime"]
}

This is an inventory example, not a provider policy. Translate the intended permissions into your provider’s policy format and test them in a staging environment.

Reduce access in steps

Replace wildcard resources where practical, remove unnecessary actions, and prefer short-lived credentials. Stage changes with observability and a rollback plan. Confirm both ordinary operation and expected failure handling before rollout.

Assign an owner and review date. Identity security improves when permission changes become a routine part of service maintenance.