How do I implement a Zero Trust Architecture in a multi-cloud AWS and Azure environment?

All answers to this question.

The key to multi-cloud Zero Trust is decoupling the Identity Provider (IdP) from the cloud service provider. Using a centralized solution like Okta or Ping Identity as your "source of truth" allows you to push consistent claims to both AWS and Azure via SAML or OIDC. You must implement "Least Privilege" by using dynamic, short-lived credentials rather than long-lived IAM keys. Focus on the "Policy Decision Point" (PDP) to evaluate every request regardless of where it originates. In multi-cloud, automation is your best friend—use Terraform or Pulumi to ensure that security groups and network ACLs are mirrored and audited across both environments to prevent configuration drift.

   Answered 2025-04-20 by Kimberly Vance

Are you planning to use a Cloud Access Security Broker (CASB) to sit between your users and these cloud environments to gain better visibility into shadow IT and data exfiltration?

   Answered 2025-05-12 by Steven Clark

• We are currently evaluating CASB vendors, Steven. My main concern is the latency introduced by hair-pinning traffic through a broker. We are leaning towards an API-based CASB approach that monitors the control plane rather than a proxy-based one. This should allow us to maintain performance while still getting the deep visibility we need into how sensitive data is being shared across our Azure and AWS buckets.

     Commented 2025-05-28 by Marcus Whitmore

Don't forget that Zero Trust also applies to the network layer. Micro-segmentation within your VPCs and VNets is essential to stop lateral movement if a breach occurs.

   Answered 2025-06-15 by Heather Collins

• Heather is spot on. Without micro-segmentation, identity-based security is just a shiny lock on a very flimsy door. It is the second line of defense that everyone forgets.

     Commented 2025-06-22 by Brandon Miller