The Not So Boring Threat Model of CSP-Managed NHI's

Kat Traxler walks through the identities that cloud providers create and operate on a customer's behalf, including AWS service-linked roles, Google Cloud service agents and Microsoft first-party app service principals. These are not the users or roles an administrator builds, which makes them easy to overlook. The talk uses a threat-modeling approach: what is being built, what can go wrong, and what can be done about it.

Risks differ by provider. AWS's multi-tenant design lets one provider principal act across many customer accounts, so a bucket policy that trusts it broadly can be abused in a cross-service confused deputy scenario. Google's service agents are single-tenant per project but often start with powerful permissions, so a user who cannot read a bucket directly may reach it through the agent. For Microsoft, a long-term credential can be added to a first-party service principal, letting an attacker authenticate as that service, a capability the speaker said AWS and Google Cloud do not offer.

Controls differ too. Only AWS lets a customer restrict these trusted principals directly, using condition keys in resource policies. On Google Cloud, the fix lies with the provider, so issues should be reported to Google. On Microsoft, an app instance property lock could block credential additions, but only the publisher can set it and it has not been applied consistently. The speaker suggested detective monitoring as the main lever for customers and closed with an informal grading of the three designs.