Cloud Service Provider Partnership Portals: A Perfect Storm Of Half-Baked IAM Controls, Non-Technical Users, And Permissions-Hungry Vendors

No ratings

Presented at fwd:cloudsec 2024 by

Laura Haller

While Cloud Service Provider (CSP) Partner Centers don’t contain traditional cloud infrastructure like VMs, ALBs, or VPCs, they are a crucial part of the cloud ecosystem: they’re how your company delivers marketplace offerings to other cloud customers. If they’re compromised, your company’s reputation is on the line, and compromised offerings could wreak havoc in customer environments. The talk will dive into the technical details of how these portals fail to give security teams a full set of guardrails, how cloud security practitioners can work with what’s currently given to them, and how CSPs can improve their offerings. This talk is particularly relevant for those who work at companies that publish products to the public cloud marketplaces, and possibly eye-opening for those that work at companies that consume those offerings.