GCP and AWS Identity Federation - Lessons Learned from the Field for Cross-Cloud Forensics and Incident Response

Learn about identity federation between GCP and AWS in this 25-minute conference talk from fwd:cloudsec Europe 2024, presented by Spotify security engineers Marcus Hallberg and Attila Dulovics. Dive deep into implementing AssumeRoleWithWebIdentity API in production environments, exploring both native cloud SDKs and custom self-signed token services. Discover practical approaches for cross-cloud forensics and incident response, including methods for collecting forensic artifacts between GCP projects and AWS accounts. Gain valuable insights from real-world production implementation experiences at Spotify, understanding service identity verification across different cloud providers, and explore automation techniques for cross-cloud forensic purposes.