Lesson 05 — Identity & Permissions

Welcome

In modern serverless environments, identity is the new security perimeter.

Unlike traditional infrastructure where network firewalls protected applications, serverless workloads communicate directly with cloud services using identities and permissions.

Every serverless function executes with an identity that determines what resources it can access.

If that identity is compromised or granted excessive permissions, attackers can quickly move throughout the cloud environment without ever exploiting an operating system or virtual machine.

Enterprise cloud breaches frequently occur because of:

Excessive IAM permissions
Misconfigured Service Accounts
Weak Managed Identities
Cross-account trust relationships
Insecure resource policies
Privilege escalation paths

As a Cloud Penetration Tester, your responsibility is to evaluate identity configurations, identify privilege escalation opportunities, and determine whether organizations follow the Principle of Least Privilege.

This lesson introduces enterprise identity security using the GoHackersCloud Enterprise Serverless Security Assessment Framework.

Learning Objectives

After completing this lesson, you will be able to:

Understand serverless identity architecture.
Assess IAM roles and permissions.
Review Managed Identities and Service Accounts.
Evaluate resource policies.
Identify privilege escalation paths.
Assess trust relationships.
Review identity governance.
Perform enterprise identity security assessments.

Business Scenario

CloudNova Technologies has been engaged by MedSecure Global to perform a security assessment of its multi-cloud serverless environment.

The organization operates hundreds of AWS Lambda functions, Azure Functions, and Google Cloud Functions supporting healthcare applications, financial systems, and enterprise automation.

Executive leadership is concerned that overly permissive identities may allow attackers to move laterally between cloud services.

Your consulting team has been tasked with reviewing identity architecture, validating least privilege, and identifying privilege escalation opportunities.

Identity in Serverless Computing

Every serverless function executes using an identity.

Examples include:

AWS IAM Execution Roles
Azure Managed Identities
Google Cloud Service Accounts

These identities determine which cloud resources the function can access during execution.

Enterprise Identity Architecture

Users

↓

Authentication

↓

Cloud IAM

↓

Serverless Function

↓

Execution Identity

↓

Cloud Resources

├── Storage
├── Databases
├── Secrets Manager
├── Messaging
├── AI Services
├── Logging

↓

Monitoring & Audit Logs

Identity Models Across Cloud Providers

Cloud Provider	Identity Model
AWS	IAM Roles
Microsoft Azure	Managed Identities
Google Cloud	Service Accounts

Although implementation differs, all three models follow the same principle: the function receives temporary credentials that authorize access to cloud resources.

Identity Components

Professional assessments should review:

AWS

IAM Roles
IAM Policies
Resource Policies
Trust Policies
STS Temporary Credentials

Microsoft Azure

Managed Identities
Azure RBAC
Microsoft Entra ID
Enterprise Applications
Service Principals

Google Cloud

Service Accounts
IAM Roles
IAM Bindings
Organization Policies
Workload Identity

Least Privilege

The Principle of Least Privilege requires every identity to receive only the permissions required to perform its intended function.

Review:

Resource access
Administrative privileges
Wildcard permissions
Cross-service access
Cross-account access

Least privilege significantly reduces attack opportunities.

Resource Policies

Serverless functions often interact with resources protected by resource-based policies.

Review:

S3 Bucket Policies
API Gateway Resource Policies
Azure Storage Policies
Google Cloud Storage IAM Policies
Event Source Permissions

Validate that only authorized identities can access protected resources.

Trust Relationships

Trust relationships define who or what can assume an identity.

Assess:

AWS AssumeRole policies
Azure identity assignments
Google Workload Identity
Cross-account trust
Federated identities

Improper trust relationships may enable privilege escalation.

Privilege Escalation Risks

Professional assessments should identify:

Administrator permissions
Wildcard IAM actions
Cross-account role assumption
Overly permissive Service Accounts
Excessive Azure RBAC assignments
Broad Google IAM roles
Resource policy abuse
Chained identity permissions

These weaknesses are frequently exploited during cloud penetration tests.

Identity Governance

Review governance controls including:

Identity lifecycle management
Role approval process
Permission reviews
Access recertification
Separation of duties
Privileged Access Management (PAM)
Break-glass accounts

Strong governance reduces long-term identity risk.

Identity Assessment Workflow

Architecture Review

↓

Identity Inventory

↓

IAM Assessment

↓

Resource Policy Review

↓

Trust Relationship Analysis

↓

Privilege Escalation Analysis

↓

Governance Review

↓

Risk Analysis

↓

Executive Reporting

Common Enterprise Findings

Identity assessments frequently identify:

Excessive IAM permissions
Wildcard resource access
Administrator execution roles
Unused privileged identities
Weak trust policies
Poor separation of duties
Inconsistent permission reviews
Missing identity monitoring
Weak governance
Excessive cross-account access

Enterprise Best Practices

Organizations should:

Apply the Principle of Least Privilege.
Use temporary credentials whenever possible.
Eliminate wildcard permissions.
Review identities regularly.
Secure trust relationships.
Monitor privileged activity.
Implement role-based access control.
Enable centralized identity logging.
Perform periodic access reviews.
Continuously improve identity governance.

Consultant Best Practices

Professional Cloud Security Consultants should:

Begin with identity architecture before reviewing individual functions.
Validate all execution identities.
Review trust relationships across cloud services.
Assess privilege escalation opportunities.
Evaluate governance alongside technical controls.
Prioritize findings according to business impact.
Produce executive-ready identity assessment reports.

Key Takeaways

Identity is the primary security boundary in serverless environments.
Least Privilege significantly reduces enterprise risk.
Trust relationships and resource policies require continuous review.
Identity governance is just as important as technical configuration.
Enterprise identity assessments should evaluate architecture, permissions, governance, and operational maturity together.

Lesson Summary

In this lesson, you learned how enterprise serverless environments rely on IAM Roles, Managed Identities, and Service Accounts to securely access cloud resources.

You explored identity architecture, least privilege, trust relationships, resource policies, privilege escalation risks, governance, and enterprise assessment methodologies that enable Cloud Penetration Testers and Cloud Security Consultants to evaluate identity security across AWS, Azure, and Google Cloud.

What’s Next?

➡️ Lesson 06 — Secrets Management

In the next lesson, you will learn how enterprise organizations securely manage secrets, API keys, certificates, encryption keys, and sensitive configuration data using AWS Secrets Manager, Azure Key Vault, Google Secret Manager, KMS services, and enterprise key management practices while applying the GoHackersCloud Enterprise Serverless Security Assessment Framework.