Has anyone pulled off a clean, least-privilege model using Microsoft Entra ID as the primary IdP with AWS IAM Identity Center and GCP Workforce Identity Federation, without proliferating hundreds of per-app roles? I’m mapping a design where GitHub OIDC issues short-lived creds to all three clouds and SPIFFE IDs handle service-to-service, and I’d love war stories or guardrails before I lock the reference architecture this quarter…
Skip per-app roles: send Entra groups (team, env, app) as claims and map them to AWS aws:PrincipalTag via Identity Center and to GCP Workforce Pool attributes, then enforce with ABAC/conditions on 6–8 shared permission sets. > clouds and SPIFFE IDs handle service-to-service, and I’d love war stories or guardrails before I lock Agree — lock GitHub OIDC aud/sub to repo:env with <= 60m TTL, and backstop with AWS SCPs and GCP org policies; want a sample Entra claim map and condition examples?
Quick win: keep roles generic and enforce via attributes — enable transitive session tags in AWS Identity Center permission sets and mirror those keys in your GCP Workforce Pool attribute mapping, then use IAM Conditions/ABAC to gate prod; this doc helps: Attribute-based access control - AWS IAM Identity Center. For humans, make Entra groups PIM-eligible and map them to AWS permission sets and GCP roles for JIT so you don’t end up with Gremlin‑grade group sprawl. Are you already passing a repo/environment claim from GitHub OIDC to restrict workload roles?