Project: prove a cloud deployment's authority and audit trail

Last updated: 1 Oct 20269 min read

project

Use disposable member accounts, a temporary audit bucket, a test compute service, synthetic payout objects, and an encryption key created solely for this drill. Define expected allowed and denied API calls before writing policies. Keep the test identities separate from the role that can inspect audit evidence. Record account identifiers, policy versions, resource identifiers, and start and end times in a local test ledger; do not put credentials or signed requests into that ledger.

Prove delegation boundaries

Create a deploy role whose identity policy permits writing a narrow object prefix, with a boundary that denies unrelated security changes. Exercise one permitted write and one key-policy change that must fail, then trace both outcomes across the identity, boundary, session, organization, resource, and key-policy layers. Delegate creation of an archive worker role while requiring its boundary and restricting PassRole to the reviewed compute service. Attempt to create an unbounded role, pass an administrator role, and change trust to an outside account. Each negative test needs a request identifier and a confirmed denial. A successful role creation alone is not acceptance; launch the worker and inspect the final trust and permissions.

Probe attributes and service callers

Use a protected project tag to limit access to synthetic payout records. Verify an own-project read, another-project denial, and denials for missing, removed, or forged tags. Then configure a named audit trail to write into the test bucket. Limit its resource policy to the intended service source and account, prove the approved trail delivers, and confirm an unapproved trail cannot write. If a condition blocks the approved service's auxiliary call, correct the exact action without broadening every destination prefix.

Authorization and audit acceptance
Permitted deploy write succeeds; prohibited key change fails
New worker role has required boundary and restricted PassRole
Forged project tag and cross-project read fail
Unapproved service source cannot write audit objects
Role chain retains reviewed source identity and project attribute
Temporary key grant permits only intended context
Object-read audit event is present for selected prefix
Digest validation detects a changed or missing log file

Trace sessions and grants

Assume a tools role, then a production-like deploy role with a reviewed source identity and transitive project tag. Test a missing or forged tag, and expire one disposable session during a resumable job. Inventory the key's grants, create a constrained temporary copy grant, verify expected and mismatched encryption contexts, then retire the grant after the copy completes. Confirm that an older encrypted payout object remains readable by the recovery role. Do not retire a real service grant merely to pass this exercise.

Validate audit evidence

Inspect event selectors before claiming data-plane coverage. Perform one approved object read, one denied read, and one policy change; locate all selected probe records after delivery. Carry forward prior management-event coverage when editing selectors. Enable integrity digests for the test window, validate the chain, then alter and remove files only in a disposable copy to prove the verifier reports tampering and gaps. Record selector scope, delivery delay, disabled intervals, and unverified hours. Report which claims were proven by live API calls and which remain policy review only. Clean up test roles, grants, resources, and audit files after preserving the results needed for review.

Common Mistakes

Do not grant administrator access to bypass one unexplained denial.
Do not let a role creator change its own boundary or trusted attributes.
Do not claim audit completeness from an intact digest when selectors excluded the target action.

Connected lessons

devops

project