Broken access control in hybrid cloud is still an IAM problem

At a glance

What this is: NHI Mgmt Group's analysis, drawing on P0 Security's blog post: Broken access control in hybrid cloud is fundamentally an IAM and authorization governance problem, not a login problem.

Why it matters: For IAM, PAM and NHI programmes, the issue is that static entitlements and inconsistent enforcement let authenticated users and workloads exceed intended scope across clouds and on-prem systems.

👉 Read P0 Security's analysis of broken access control in hybrid cloud and IAM

Context

Broken access control persists when authenticated identities can do more than they should after login. In hybrid cloud, that gap is created by inconsistent entitlement models across AWS, Azure, Kubernetes and on-prem systems, where the same identity can be governed differently in each environment.

The core governance problem is not identity proofing but runtime authorization. When roles, group memberships and policies drift faster than review cycles, security teams lose confidence in who can access what right now, and privilege creep becomes part of the control plane itself.

Key questions

Q: What breaks when broken access control is treated as a purely application-layer issue?

A: Teams miss the service and token boundaries where authorization actually fails. In modern applications, privilege is often expressed through APIs, workload tokens, and internal calls, so a user-centric view leaves the real trust path unprotected. Security teams need to test where authorization is enforced, inherited, and bypassed across the application stack.

Q: Why do static entitlements increase risk in hybrid cloud environments?

A: Static entitlements outlive the systems and tasks they were meant to support. When compute instances, containers and workloads change faster than roles or group memberships, excess access accumulates and least privilege erodes. The result is a control gap where permissions remain valid even though the operational need has disappeared.

Q: How can teams tell whether access governance is actually working?

A: Look for short revocation times, low rates of stale entitlements, and repeatable access review outcomes across systems. If accounts remain active after role changes or offboarding, governance is not effective. Good measurement focuses on whether access is removed when it stops being justified.

Q: What should teams do when user, workload and service account access all cross the same environments?

A: Treat every identity type as part of one authorization fabric. User accounts, service accounts, workload identities and API keys can all bridge production, CI/CD and management planes, so governance must evaluate the combined blast radius, not each environment or identity class in isolation.

Technical breakdown

Why static entitlements fail in dynamic cloud estates

Hybrid cloud infrastructure changes faster than traditional IAM assumptions. Workloads scale up and down, containers are redeployed, and temporary admin access often outlives the task it was meant to support. Static roles and group memberships were designed for fixed servers and predictable boundaries, not for ephemeral infrastructure that moves between platforms. When entitlement lifetimes are longer than workload lifetimes, least privilege stops being a state and becomes an aspiration. Practical implication: treat entitlement duration as a control variable and not a documentation artifact.

Practical implication: track privilege duration against workload lifespan and remove any access that survives the task boundary.

How inconsistent policy enforcement creates broken access control

Each cloud and directory layer interprets access differently. AWS IAM policies, Azure AD roles, Kubernetes RBAC and on-prem directories all express permissions in ways that do not map cleanly to one another, so a control that appears restrictive in one environment can be porous in another. That creates fragmented enforcement, where effective access depends on where the identity lands rather than on a single governed policy. Broken access control emerges when authorization semantics diverge across control planes. Practical implication: assess effective permissions across environments, not policy text in isolation.

Practical implication: validate effective permissions across clouds and directories, not just the policy definitions you think are in place.

Why visibility into effective access is the control that matters

Access governance fails when teams cannot answer who can access what right now. Quarterly recertification and point-in-time reviews miss drift, toxic combinations and stale entitlements that accumulate between review windows. In a hybrid estate, the problem is amplified because the same identity can bridge production, CI/CD and management planes through user, service account, workload identity or API key. That means the exploitable condition is not only excessive access, but unknown effective access. Practical implication: prioritize continuous entitlement discovery and analysis over periodic attestation alone.

Practical implication: build continuous entitlement discovery so you can detect drift before it becomes exploitable access.

Threat narrative

Attacker objective: Exploit excessive or inconsistent authorization to move laterally and reach systems or data that the identity should not be able to touch.

1. Entry occurs after authentication, when an identity with excessive or stale permissions is used within the bounds of a legitimate login or token.
2. Escalation happens as the identity inherits or retains broader access than intended, often through long-lived roles, group memberships or inconsistent cross-cloud enforcement.
3. Impact follows when the compromised or over-permissioned identity is used to move laterally across production systems, CI/CD pipelines or management planes.
4. The attacker objective is to exploit the gap between authentication and authorization so that access exceeds intended scope without needing to break login controls.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Broken access control is now an identity governance failure, not a developer-only defect: The article shows that the real control gap sits in how permissions are governed across heterogeneous estates. Authentication can be sound while authorization still fails, which is why hybrid cloud exposes IAM as the deciding control plane. Practitioners should treat broken access control as runtime entitlement governance.

Static entitlement models cannot keep up with ephemeral infrastructure: The article’s strongest point is that cloud assets are transient while many access policies remain long-lived. That mismatch creates standing permission beyond the useful life of the workload, which is why least privilege erodes in practice. The implication is that entitlement duration has become as important as entitlement scope.

Identity is the connective tissue that turns one compromise into multi-environment reach: User identities, service accounts, workload identities and API keys all bridge production, CI/CD and management planes. Once one of those identities is over-permissioned, lateral movement no longer depends on exploiting a new vulnerability. Practitioners need to govern the identity path between environments, not each environment in isolation.

Runtime entitlement governance is the named control concept this category now needs: Broken access control persists because access is still judged too often at provision time and too rarely at runtime. That assumption was designed for stable estates with fixed boundaries. It fails when identities span cloud control planes and permissions drift continuously, so teams must rethink how authorization is observed, not just how it is granted.

OWASP Top 10 prominence here is a signal about operating model drift: When broken access control remains the top risk year after year, the issue is not awareness but control architecture. Hybrid cloud has outgrown review cycles, manual approvals and environment-specific policy islands. Practitioners should read this as evidence that authorization governance now needs continuous enforcement and continuous evidence.

What this signals

Runtime entitlement governance: Hybrid cloud pushes authorization decisions into a moving target, which makes periodic review too slow to be trustworthy. Security teams should shift their evidence model from scheduled certification to continuous visibility over effective access.

Access control problems now arise because identities bridge environments that were never designed to share a single permission model. That is why least privilege needs to be enforced at runtime, across cloud, directory and workload boundaries, rather than assumed at provisioning time.

For practitioners

• Implement runtime entitlement governance Continuously discover, evaluate and revoke effective permissions across AWS IAM, Azure AD, Kubernetes RBAC and on-prem directories so that authorization reflects current state rather than stale provisioned access.
• Replace standing privilege with JIT access Use time-bounded, scope-limited access for admin and operational tasks, and automatically revoke it when the task or session ends so temporary elevation does not become persistent exposure.
• Measure effective access across control planes Test who can actually reach sensitive resources, not just what the policy files say, and look for toxic combinations that emerge when cloud and on-prem models are combined.
• Review non-human identities as shared pathways Include service accounts, workload identities and API keys in the same entitlement analysis as human users because they often provide the cross-environment paths attackers exploit.
• Automate least-privilege enforcement Replace spreadsheet-led approvals with policy-driven workflows that can keep pace with ephemeral infrastructure and developer change velocity without leaving excessive access in place.

Key takeaways

• Broken access control in hybrid cloud is primarily an authorization governance problem, not a failure of authentication.
• Static permissions and inconsistent enforcement let access drift beyond intended scope across cloud and on-prem environments.
• Continuous entitlement discovery and JIT access are the controls that most directly reduce the exposure described in the article.

Key terms

• Broken Access Control: Broken access control occurs when a system fails to restrict what an authenticated user, service, or workload can do. The issue often appears as missing checks, inconsistent enforcement, or excessive permissions. It is a structural weakness because attacks exploit the gap between verified identity and permitted action.
• Runtime Entitlement Governance: Runtime entitlement governance is the continuous control of what identities can actually do after authentication. It focuses on effective access, drift, and revocation across changing environments rather than on static role assignment alone.
• Effective Access: The actual permissions an identity can exercise after inheritance, nested groups, delegation, and object-level controls are evaluated. In Active Directory, effective access is more useful than direct membership because it reveals the true operational reach of a service account.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.

What's in the full article

P0 Security's full article covers the operational detail this post intentionally leaves for the source:

• The OWASP Top 10 context behind why broken access control remains a top-ranked issue
• The article's practical comparison of AWS IAM, Azure AD, Kubernetes RBAC and on-prem directories
• The rationale for moving from periodic reviews to continuous entitlement governance
• The specific examples of how temporary elevation becomes permanent in hybrid estates

👉 P0 Security's full article expands on why authorization governance, not login controls, is the real issue in hybrid estates.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.