Hardening Cloud Workloads: Least-Privilege IAM & DevSecOps Guardrails

1. Enforcing Immutable IAM Permissions Boundaries

In fast-moving engineering organizations, granting developers or CI/CD pipelines iam:CreateRole often leads to privilege escalation where a user attaches AdministratorAccess to their newly created role.

An IAM Permissions Boundary sets the maximum permissions that an identity-based policy can grant. Even if a role attaches *:*, its effective permissions can never exceed the boundary.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowedServicesWithBoundaries",
      "Effect": "Allow",
      "Action": ["s3:*", "ec2:*", "rds:*", "eks:*", "lambda:*"],
      "Resource": "*"
    },
    {
      "Sid": "DenyPrivilegeEscalation",
      "Effect": "Deny",
      "Action": ["iam:CreatePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeletePolicyVersion"],
      "Resource": "*"
    },
    {
      "Sid": "RequireBoundaryOnNewRoles",
      "Effect": "Deny",
      "Action": ["iam:CreateRole", "iam:PutRolePermissionsBoundary"],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "iam:PermissionsBoundary": "arn:aws:iam::123456789012:policy/DevPermissionsBoundary"
        }
      }
    }
  ]
}

2. Keyless CI/CD Authentication with OpenID Connect (OIDC)

Hardcoded AWS Access Key IDs and Secret Access Keys stored in GitHub Secrets represent one of the primary vectors for cloud credential leakage.

Configuring an AWS IAM OIDC Identity Provider allows GitHub Actions to request short-lived (15–60 minute) STS credentials scoped strictly to specific repositories and branches.

resource "aws_iam_role" "github_actions" {
  name = "github-actions-deploy-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Federated = aws_iam_openid_connect_provider.github.arn
        }
        Action = "sts:AssumeRoleWithWebIdentity"
        Condition = {
          StringEquals = {
            "token.actions.githubusercontent.com:aud" : "sts.amazonaws.com"
          }
          StringLike = {
            "token.actions.githubusercontent.com:sub" : "repo:SIKANDERKUMBHAR/technofreaks-website:ref:refs/heads/main"
          }
        }
      }
    ]
  })
}

3. Automated Container Security & CVE Gates in CI/CD

Vulnerability scanning must happen shift-left in the build pipeline rather than post-deployment. Integrating Aqua Trivy into GitHub Actions breaks the build if CRITICAL or HIGH severity CVEs with available fixes are detected in base OS packages or application dependencies.

- name: Run Trivy Vulnerability Scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'technofreaks/app:latest'
    format: 'table'
    exit-code: '1'
    ignore-unfixed: true
    vuln-type: 'os,library'
    severity: 'CRITICAL,HIGH'

4. Kubernetes Workload Identity via EKS Pod Identity

Granting broad IAM roles to EC2 worker nodes means any pod running on that node can query the IMDSv2 metadata endpoint and inherit full node permissions.

Deploying EKS Pod Identity or IAM Roles for Service Accounts (IRSA) ensures each Kubernetes ServiceAccount receives temporary, least-privilege AWS credentials mounted directly into the pod container.

5. Real-Time In-Kernel eBPF Threat Detection with Tetragon

Traditional log inspection detects security incidents after damage has already occurred. In-kernel eBPF instrumentation with Cilium Tetragon monitors Linux kernel syscalls (e.g. execve, socket_connect, bprm_comm) in real time.

Tetragon can enforce kernel-level execution policies, terminating malicious processes (such as reverse shells or unauthorized crypto-miners) before data exfiltration occurs.