TR NotesAWS, Azure, GCP & connected environments.
Using a hypothetical OCI, Google Cloud, Azure, and AWS deployment, this article reviews interconnects, routing control planes, Kubernetes networking, private endpoints, and multicloud security operations.
This article distinguishes the Gemini app, Workspace-integrated features, and Gemini Enterprise; reviews their data-access and administrative boundaries; and uses the publicly disclosed, patched GeminiJack case as historical context for indirect prompt-injection risk.
This article reviews Workspace domain and directory boundaries, organizational units, administrator roles, 2-Step Verification, federation, API controls, domain-wide delegation, unmanaged accounts, and federation with Apple Business Manager.
This article reviews consumer and managed identities, the Google Cloud organization-folder-project hierarchy, service-account credentials, and the relationship between Cloud Billing accounts and Google payments.
This article reviews Microsoft 365's layered authorization model, its boundaries with Azure, workload access paths, Microsoft Graph application permissions, Copilot data access, and the control planes for Sentinel, Purview, Defender, and Intune.
This article examines Microsoft Entra tenant, Azure subscription, and billing boundaries; role systems and workload identities; and the hybrid authentication paths connecting on-premises Active Directory with Microsoft Entra.
AWS concentrates identity, credentials, trust, and billing around the account boundary. This article reviews the root user, the management account's payer role, credential lifetimes, and cross-account authorization.