Topic
The identity and permission layer underneath everything else: IAM roles and policies, SCPs and guardrails, cross-account and cross-tenant access, and the gap between what a console shows and what a principal can actually do, in both AWS and Azure.
Cloud Security · 9 min
Cloud SecurityOwner and User Access Administrator are root for everything beneath them, and Global Administrator is one setting from both. The fix is removing standing access: PIM for people, tighter controls for the identities PIM can't cover.
Read →Cloud Security · 8 min
Cloud SecuritySCPs set the ceiling that still holds when an IAM policy is wrong. Paired with resource control policies, they're how you draw a real boundary around your data.
Read →Case study · 5 min · Aug 18, 2026
A tenant-wide inventory of standing Owner and User Access Administrator found four assignments on one subscription. Three of them were not people. PIM could cover the human. It could not cover the pipeline, the vendor identity, or the Global Administrator setting left on from a cleanup.
Azure CLI · Microsoft Entra PIM · Azure Lighthouse
Read →Case study · 5 min · May 20, 2026
A weekend AdministratorAccess grant outlived the migration. The SCP kept the role from leaving the org or turning off CloudTrail. It couldn't stop a bucket policy from trusting an account we didn't own. I treated the deny as the ceiling, then added resource control policies for the data path.
AWS Organizations · CloudTrail · AWS Config · GuardDuty
Read →