☁   KNOWLEDGE AREA

Cloud & containers

Workloads, control planes, credentials, and isolation.

9 topics

Cloudadvanced

CI credentials and OIDC trust conditions

CI systems often exchange an OIDC token for cloud credentials.

ci-and-oidccloud
Cloudintermediate

Cloud IAM policy evaluation and effective permissions

Cloud authorization combines identity policies, resource policies, organizational controls, permission boundaries, session policies, and service-specific conditions.

iam-policy-evaluationcloud
Cloudintermediate

Cloud instance metadata and workload identity

Instance metadata can expose configuration and temporary credentials to software running on a workload.

instance-metadatacloud
Cloudintermediate

Container images, layers, and deleted build-time secrets

Container images are layered filesystem snapshots plus configuration.

container-images-and-secretscloud
Cloudintermediate

Kubernetes RBAC and resource-specific authority

Kubernetes RBAC grants verbs over resources within a namespace or cluster.

kubernetes-rbaccloud
Cloudintermediate

Object storage: listing, reading, and publication controls

Object storage has separate permissions for listing a container, reading an object, writing it, and changing access policy.

object-storagecloud
Cloudintermediate

Role assumption, trust policy, and session scope

Assuming a role exchanges one identity context for a temporary session governed by a trust policy and permissions.

role-assumptioncloud
Cloudintermediate

Serverless workloads: execution identity and event trust

A serverless function has a deployment artifact, execution identity, environment, triggers, and event payload.

serverless-boundariescloud
Cloudadvanced

Transitive control of Entra application identities

Model credential authority and consent as typed graph edges rather than treating visible roles as effective privilege.

entra-idservice-principalidentity