J. Passing

Wrote up a 2-part deep-dive on the many types of authentication tokens used by #GoogleCloud: cloud.google.com/docs/authentic… cloud.google.com/docs/authentic…

With the latest version of JIT Groups, it's now easier to manage just-in-time, self-service access to #Kubernetes resources on #GoogleCloud jpassing.com/2025/07/23/usi…

Just published: two new articles about how to best use context aware access for securing apps and resources on Google Cloud cloud.google.com/architecture/s… cloud.google.com/architecture/s…

Just published: Using Workforce Identity Federation and Entra App roles (instead of groups) to control access to Google Cloud jpassing.com/2025/03/20/usi…

Just published: JIT Groups, or what's next for the JIT Access project jpassing.com/2024/09/06/jit…

Just published 'Best practices for securing SSH access to VM instances', a four-part guide on how to mitigate common risks (and why to use IAP and OS Login) cloud.google.com/compute/docs/c… #GoogleCloud /cc: @lancinimarco

@revbl0ck I'm glad I added a warning about this to our docs some time back... FWIW, I think the underlying issue is that GitHub uses the same issuer across all tenants: #tenant-specific-issuer" target="_blank" rel="nofollow noopener">cloud.google.com/iam/docs/use-w…

Finally got around to write my first #infosec blog post. This one is on #gcp and #github OIDC deployment roles and how a misconfiguration can catch you out. revblock.dev/exploiting-mis…

Just-in-Time Access 1.4 is out, introducing UI improvements, additional configuration options, and the ability to choose the duration for which to activate a role. github.com/GoogleCloudPla… #GoogleCloud #IAM

Published a new article on how to extend a platform or service to support workload identity federation, and some best practices to follow cloud.google.com/iam/docs/use-w…

Service account keys on #GoogleCloud aren’t like AWS access keys, they’re riskier jpassing.com/2022/04/21/ser…

Managing just-in-time privileged access to #GoogleCloud resources... there's now an app for that jpassing.com/2022/04/13/ena…

Keeping track of SSH keys on #GoogleCloud can be tricky, especially when using metadata-based keys. But with IAP Desktop 2.26, it gets a little easier. jpassing.com/2022/04/09/kee…

When developing locally, we sometimes have to do things that only service accounts can do... but that's not a good reason for using service account keys jpassing.com/2022/04/08/doi… #GoogleCloud #Security

To call certain Google APIs, we sometimes have to use domain-wide delegation. But using domain-wide delegation doesn’t mean we have to use service account keys. jpassing.com/2022/01/15/usi… #googlecloud #oauth

By using IAP, we can ensure that an application only receives requests that are authenticated and satisfy context-aware access policies. But there are still a few things that a web application needs to do itself: jpassing.com/2022/01/09/usi… #GoogleCloud #ZeroTrust

@lancinimarco Thanks for including my 'Best practices for using workload identity federation' article in cloudseclist.com/issues/issue-1…

Older #dotnet versions don't provide an easy way to import RSA public keys, but with a little help from #CryptoAPI, we can fill that gap jpassing.com/2021/12/05/imp…

Back to basics... how PEM is used to encode public keys jpassing.com/2021/11/30/usi…

Back to basics... how do you make sense of a PEM file? jpassing.com/2021/11/27/wha…

Blogged: Authenticating to Azure by using Cloud KMS and client assertions #azure #googlecloud #security jpassing.com/2021/09/03/aut…