5 Must-Know Open Source Identity Management Tools For Cloud Native Stacks

The talk starts from the view that identity ties together most security domains, and that cloud environments often expose weak identity administration. Much of the risk comes from over-broad credentials and provisioning that is manual, hard to repeat and hard to reason about. The speaker argues for treating the identity layer as part of each application's threat model and managing it with the same version-controlled, automated practices used for software delivery.

Using attack trees, the speaker maps how an attacker could reach sensitive data in a containerized application. The example shows that stolen cloud credentials and over-permissioned database access can bypass application defenses entirely. The AWS tools covered include a utility that migrates existing accounts into Terraform, Parliament, which runs unit-test style checks against IAM policies, and IAM Live, which reveals the permissions an application actually uses. The Azure tools include utilities that enumerate service principals and managed identities, a set of conditional access policies deployed in stages, a database of Azure permissions with risk classifications, and a tool that maps identities to Microsoft's Enterprise Access Model.

The takeaway is that tools only help when paired with threat modeling, sensible review processes and policy tests written as code. Invariants, such as limiting a key to one bucket or restricting a database user to expected network ranges, can then fail a build when they are broken. The speaker presents the approach as work in progress rather than a finished recipe.