Vault or your cloud's secret manager
The choice is not about features. It is about whether you are multi-cloud, whether you need short-lived database credentials, and how much operational load your team can carry.
Blog
Identity and access
Articles about Identity and access from the ConsultorIA blog: cloud, applied AI and security in production.
“Read-only” is a claim until something checks it: how Skyline verifies credentials before scanning
Most inventory tools ask for read-only access and trust you got it right. We made Skyline prove it first, because the ReadOnlyAccess policy a team hands you is very often not what they think it is.
Rotation nobody does, because it breaks things
Rotation fails when the application reads the secret once at startup. Two valid credentials during the change window, an inventory that is real, and deletion instead of rotation for the credentials that should not exist at all.
Several teams, one cluster, without anyone standing on anyone
A namespace is a naming boundary, not a security boundary. Quotas, default-deny network policy, workload identity and a clear answer on node isolation are what make a shared cluster work.
A Kubernetes Secret is base64, and everyone learns this too late
Getting secrets out of manifests means an operator that syncs from your cloud's vault, a driver that mounts them, or both. The part that decides which is what your application does when the value changes.
Least privilege in AWS without guessing: the Access Analyzer workflow
Nobody writes a minimal IAM policy from a blank page. You harvest it from what the role actually did. Here is the loop we run to shrink permissions without breaking production.
Getting long-lived cloud keys out of your CI
The static access key in your pipeline is the credential most likely to end up in a breach report. OIDC federation removes it in an afternoon, and the trust policy is where people get it wrong.
Eight open-source tools we run in every cloud posture review
A posture review is only as good as its coverage. These are the scanners, IAM analysers and infrastructure-as-code checkers we run on AWS, Google Cloud and Azure, what each one is good at, and where it misleads.
Permissions for agents that act: sizing the blast radius before you hand over the keys
An agent is an identity that takes instructions from text it did not write. Scope it like a service account you assume is partly compromised, because in the injection case it is.
Service account keys are the GCP credential that leaks. Here is how to stop creating them
Almost every Google Cloud incident we have investigated started with a JSON key file. Workload Identity Federation removes the need for them entirely, and the migration is smaller than you think.
BloodHound and the identity attack path: from a helpdesk account to domain admin
Identity is where the escalation happens, and graphs are how you see it. What BloodHound reveals about Active Directory and Entra ID, how to read the paths, and which edges are worth cutting first.
Secret scanning with Gitleaks and TruffleHog, and what to do the moment one is found
Finding a credential in git history is the easy part. The hard parts are verifying it is live, rotating it without an outage, and stopping the next one — in that order, and usually within the hour.
Conditional Access policies that hold, and the emergency account you must create first
Conditional Access is the strongest control in Entra ID and the easiest way to lock your entire organisation out of its own tenant. Here is the baseline set, and the order to deploy it in.
OCI policies read like English, which is why they are easy to get dangerously wrong
An OCI policy statement is one readable line, and one readable line can grant far more than it appears to. Here is how we write, verify and constrain them.