A Multi-Cloud Framework for Zero-Trust Workload Authentication

TL;DR

The paper addresses the security risks of static, long-lived credentials in multi-cloud environments by proposing a practical, secretless Zero-Trust workload authentication framework built on Workload Identity Federation (WIF) and OpenID Connect (OIDC). It replaces persistent secrets with ephemeral, audience-bound tokens issued by a local IdP and exchanged for short-lived native cloud credentials through the RP, enabling scalable cross-cloud trust. Through an enterprise-scale case study, it demonstrates significant reductions in attack surface, simplified audits, and faster cross-cloud access provisioning, while preserving fine-grained access controls via token audience, subject, and attribute conditions. The work provides a blueprint for unified workload identities across AWS, Google Cloud, and Azure, with measurable improvements in security and operational efficiency and clear avenues for future enhancements such as ABAC integration and Just-in-Time credential issuance.

Abstract

Static, long-lived credentials for workload authentication create untenable security risks that violate Zero-Trust principles. This paper presents a multi-cloud framework using Workload Identity Federation (WIF) and OpenID Connect (OIDC) for secretless authentication. Our approach uses cryptographically-verified, ephemeral tokens, allowing workloads to authenticate without persistent private keys and mitigating credential theft. We validate this framework in an enterprise-scale Kubernetes environment, which significantly reduces the attack surface. The model offers a unified solution to manage workload identities across disparate clouds, enabling future implementation of robust, attribute-based access control.

Figures (3)

• Figure 1: Workload Identity Federation with OIDC Flow
• Figure 2: Federated Architecture for GCP to AWS Access
• Figure 3: Federated Architecture for AWS to GCP Access