Exploring Identity Integrations between the Three CSPs and their Managed Kubernetes Offerings
Source: YouTube · SANS Cloud Security · published Oct 25, 2024 · 24:03
Staff Security Engineer Dakota Riley demystifies the complex integration of Kubernetes and cloud provider identity across AWS, GCP, and Azure, highlighting critical security edge cases and actionable defense strategies 1:15.
Key Takeaways:
• Riley approaches the topic as a hands-on security engineering practitioner spanning cloud, application, and detection domains 0:20.
• Managed Kubernetes introduces dual control planes (cloud provider and Kubernetes) with complex authentication flows, as 73% of cloud Kubernetes runs on managed distributions 0:50.
• AWS EKS's legacy aws-auth ConfigMap grants implicit cluster creator access that persists even after migrating to Access Entries, while Access Entries enable cross-account access but require manual kubeconfig generation 5:30.
• GKE enables seamless GCP IAM integration and cross-project access via Kubernetes RBAC without explicit project invitations, while the "system:authenticated" group exposes access to any Google user 10:15.
• Azure AKS local accounts use static, non-rotating client certificates that obscure user identity in audit logs—administrators should disable them in favor of Entra ID integration 15:45.
• Defense strategies include IP allow-listing, early security partnership in design, monitoring cloud audit logs for IAM changes, and auditing cluster-level RBAC objects 20:30.
Riley concludes that no single identity method is universally superior—organizations must choose based on their environment's context and ensure managed Kubernetes identity configurations have a place in their risk register.
Sources:
- [0:20](https://w
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
all right are we working okay first off thank you for sticking it out to later in the day I'm an East coaster so I would normally be going to bed in like 30 minutes so yeah and no coffee for me before talking um so just a quick introduction about myself I'm Dakota Riley currently a staff security engineer at live RAM and the easiest way to describe what I do is I'm a security engineering practitioner uh I've worn a lot of different hats across Cloud Security application security always some kind of automation more lately detection and response so um willingly or unwillingly I've done a lot of random security stuff and when I'm not doing that security stuff I live in northern Kentucky with my life wife I have three cats I'm either playing video games or outside hiking so just a quick agenda…