PROJECT-05 / Cloud identity security
AZ-01 — Azure Workload Identity Attack & Secretless Federation Lab
A validated Azure lab tracing a deliberately vulnerable long-lived workload credential and excessive RBAC through controlled attack validation, secretless federation remediation, revalidation, and verified teardown.
- State
- Validated
- Platform
- Microsoft Azure / Microsoft Entra ID / GitHub Actions
01 /Security Objective
Validate a bounded workload identity attack path and remediate credential and authorization risks using secretless federation and reduced Azure RBAC scope.
Category: Cloud identity security
02 /Architecture Overview
A Microsoft Entra workload identity accesses synthetic Azure Storage targets, with a separate project-owned negative control. A later validation deployment uses GitHub OIDC federation and container-scoped Storage Blob Data Reader access.
Platform scope
- Microsoft Azure
- Microsoft Entra ID
- GitHub Actions
CONTROL /Controls in Scope
- Microsoft Entra ID
- Azure RBAC
- GitHub OIDC
- Workload Identity Federation
- Terraform
- Least privilege
03 /Implementation Record
Terraform defines the vulnerable identity baseline and later GitHub OIDC + Microsoft Entra workload identity federation remediation. Least-privilege Azure RBAC reduction limits the intended read path to one synthetic-data container. DevSecOps hardening adds Terraform static validation, IaC scanning, and current-content secret scanning without Azure authentication.
- Delivery
- Terraform, controlled Azure CLI validation, and GitHub Actions static security CI
04 /Validation Record
- Validation method
- Bounded Azure RBAC attack-path tests use synthetic data and project-owned targets only. Positive post-remediation tests validate OIDC authentication and intended blob reads; negative tests record explicit denials for tested management-plane actions, writes, negative-control access, and account-level container listing. Terraform destroy and bounded cleanup verification document teardown; controlled CI failure validation checks the formatting gate.
- Evidence record
- Sanitized baseline, attack, federation, post-remediation, teardown, and CI validation records
WORKFLOW /Engineering Lifecycle
- 01Design
- 02Deploy
- 03Validate vulnerable baseline
- 04Controlled attack validation
- 05Capture evidence
- 06Remediate
- 07Revalidate
- 08Capture remediation evidence
- 09Destroy
- 10Verify cleanup
- 11Harden CI
05 /Current State & Limitations
Validated
Results apply only to tested actions and known project-owned targets. Baseline and remediated deployments used separate validation windows; the retired credential was not replayed in place. The Azure environment is destroyed. This lab does not establish universal least privilege, penetration-test coverage, production suitability, or broader Azure security assurance.