Managed identities in cloud: where do AWS, Google and Entra diverge?

TL;DR: CSP-managed non-human identities create different security failure modes across AWS, Google Cloud and Microsoft Entra ID, from confused deputy exposure and transitive access abuse to service principal hijacking, according to Vectra AI. The governance problem is not uniform cloud hardening, but provider-specific control ownership, because the effective defence changes with each identity model.

Editorial analysis by NHI Mgmt Group, based on content published by Vectra AI: “Cloud Security Grey Zone: Who Owns the Risk of Managed Identities?”.

Key questions

Q: What breaks when cloud-managed identities are treated as the same across AWS, Google Cloud and Entra ID?

A: Teams lose sight of who actually controls the trust boundary.

Q: Why do multi-cloud environments create more identity risk than single-cloud estates?

A: Because the risk sits in the gaps between providers.

Q: What should security teams look for when a cloud service can act on behalf of another principal?

A: Look for explicit source binding, narrow service scope and evidence that the service cannot be redirected into broader action than intended.

Practitioner guidance

• Audit AWS resource policy condition keys Review every cross-service trust relationship for aws:SourceArn or equivalent source-binding conditions, especially where services can act on behalf of another principal.
• Restrict Google Cloud service exposure Keep only the services that are operationally required enabled, then monitor service-agent behaviour for unexpected delegated actions or unusual access patterns.
• Verify Entra service principal protections Check whether appInstancePropertyLock is enabled on high-impact Microsoft first-party applications and confirm which tenant-local principals can accept added credentials.

Bottom line: Cloud-managed identities are not governed uniformly, because each provider exposes a different trust boundary and a different failure mode.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →