Shared responsibility, hierarchy và workload identity
Cloud giảm ownership vật lý/control-plane tùy service model; customer vẫn chịu data, identity, configuration và application security.
Service models
IaaS cho OS/runtime responsibility lớn; managed containers/PaaS/serverless giảm patch/control plane nhưng tăng platform constraints/lock-in. Managed DB vẫn cần schema/query/capacity/backup/permissions.
Hierarchy/governance
AWS Organizations/accounts/OUs và Azure tenant/management groups/subscriptions/resource groups tạo billing/policy/blast-radius boundaries khác nhau. Tách prod/non-prod/security/log archive và dùng organization policies/guardrails; tags không hard security.
Identity
Humans federation/SSO + MFA, workloads roles/managed identities, CI OIDC short-lived tokens. Avoid shared users/access keys/client secrets. Authorization gồm identity/resource policies, boundaries/organization controls/deny semantics theo provider.
OIDC CI flow
Workflow requests signed OIDC token with issuer/audience/subject claims → cloud trust validates repo/ref/environment/workflow → issue temporary scoped credentials → audit session. id-token: write only permits minting token, cloud trust decides access.
Least privilege
Start task-based policies, constrain resources/actions/conditions, analyze activity/access, remove unused. Separate build/publish/deploy roles. Break-glass time-bound and audited.