The cloud model and IAM

Overview

Cloud shifts security to configuration and access: under shared responsibility, the provider secures the cloud and you secure what's in it. IAM (principals + policies) is the perimeter; over-permissioning, long-lived keys, and broadly-assumable roles are the core risks. Fix: least privilege.

Why it matters

Most cloud breaches are customer-side IAM/config mistakes. With no network edge, identity is the perimeter, so finding over-privileged principals and escalation paths is the heart of cloud assessment.

Core concepts

Shared responsibility. Provider secures the cloud; you secure config/data/access. IAM. Principals + policies; identity is the perimeter. Failures. Over-permissioning, long-lived keys, broadly-assumable roles, iam:PassRole. Fix. Least privilege, short-lived credentials.

Lesson

Cloud platforms (AWS, Azure, GCP) replace owned servers with on-demand services — which moves the security questions from "patch the box" to "who can do what".

Shared responsibility

The provider secures the cloud (hardware, hypervisor, managed-service internals); you secure what's in the cloud (your configuration, data, access, and code). Most cloud breaches are customer-side misconfigurations, not provider failures.

IAM is the perimeter

Identity and Access Management (IAM) defines principals (users, roles, service accounts) and policies (who may perform which actions on which resources). In the cloud there's no network edge to hide behind — identity is the perimeter. The recurring failures:

• Over-permissioned identities (*:* / AdministratorAccess everywhere) — one leaked key becomes total compromise.
• Long-lived access keys instead of short-lived role credentials.
• Roles assumable by too-broad principals (privilege escalation via iam:PassRole, role chaining).

Why testers focus here

Cloud pentesting is largely IAM analysis: enumerate identities and policies, find over-grants, and map paths from a low-privileged principal to admin (the cloud analogue of AD attack paths). The fix is least privilege: scoped policies, short-lived credentials, and removing unused permissions.

Summary

Cloud security centers on IAM under a shared-responsibility model: the provider secures infrastructure while you secure access and configuration. Over-privilege and long-lived keys are the dominant risks, countered by least-privilege identity design.