Breaking: Our Claw security audit found a huge permissions gap. Sharing our patch workflow.

Our recent security audit, conducted by the Claw platform, revealed a critical and systemic vulnerability in our multi-cloud permission management workflow. The gap was not in the identity providers themselves—we use AWS IAM, Azure AD, and GCP IAM in a hub-and-spoke model—but in the propagation and synchronization of temporary, just-in-time access grants. We had a theoretical zero-standing-privilege model for production Kubernetes clusters, but the practical implementation had a dangerous delta. The audit found that patched vulnerabilities in our containerized workloads could be deployed for up to 72 hours before the associated, time-bound credentials for the CI/CD system were automatically revoked, creating a window where exploited pods could assume roles with far broader permissions than intended.

The forcing function was clear: we needed to rebuild our entire secrets rotation and permission revocation stack, not just for one cloud, but across AWS, GCP, and our on-premises Kubernetes footprints, all of which were managed through a shared Istio service mesh and ArgoCD deployment. The sequencing decision was paramount. We could not afford a brownout.

Our phased approach was as follows:

1. **Immediate Mitigation:** We implemented a short-lived, script-based revocation trigger tied to our vulnerability scanner (Trivy) outputs. This was a stopgap.
2. **Architecture Redesign:** We moved from a centralized secrets manager per cloud to HashiCorp Vault with dynamic secrets for *all* CI/CD and runtime service accounts, leveraging its pluggable backends (aws, azure, gcp, kubernetes). The key was making Vault the sole source of truth for ephemeral credentials.
3. **Workflow Integration:** We rebuilt our GitLab CI pipelines to obtain Vault tokens via JWT auth, with the tokens having a lifecycle explicitly tied to the pipeline run and the specific commit hash being deployed. The token is automatically revoked upon pipeline completion (success or failure).
4. **Kubernetes Integration:** We deployed the Vault Agent Injector as a Mutating Admission Webhook in our clusters. Annotations in the deployment spec request secrets, which are rendered as files in the pod. Crucially, the Vault lease is tied to the pod lifecycle.

The critical patch workflow, which closed the gap, now looks like this:

```hcl
# Vault Policy for a CI/CD pipeline deploying to AWS and k8s
path "aws/creds/cicd-role" {
capabilities = ["read"]
# Max TTL capped at 1 hour, far less than pipeline timeout
max_ttl = "3600"
}

path "kubernetes/creds/cicd-sa" {
capabilities = ["read"]
max_ttl = "3600"
}

path "sys/leases/renew" {
capabilities = ["update"]
}

path "sys/leases/revoke" {
capabilities = ["update"]
}
```

And the corresponding GitLab CI job configuration:

```yaml
deploy-production:
stage: deploy
id_tokens:
GITLAB_JWT:
aud: https://vault.ourdomain.com
script:
# Authenticate to Vault using GitLab's JWT
- export VAULT_TOKEN=$(vault write -field=token auth/jwt/login role=cicd jwt=$GITLAB_JWT)
# Retrieve dynamic AWS creds & k8s SA token
- vault read -format=json aws/creds/cicd-role > aws_creds.json
- vault read -format=json kubernetes/creds/cicd-sa > k8s_creds.json
# Use these ephemeral creds for deployment via terraform and kubectl
- terraform apply -auto-approve
- kubectl apply -f manifests/ --token=$(jq -r '.data.token' k8s_creds.json)
after_script:
# Force revocation of all leases from this run
- vault token revoke -self
```

Where things slipped was in the transition of our legacy Azure DevOps pipelines, which lacked native JWT support comparable to GitLab. We had to implement a proxy service that exchanged Azure's OIDC token for a Vault-compatible JWT, adding a week of unexpected development and security review. Furthermore, the Vault Agent Injector's default behavior on pod deletion required tuning; we initially saw a delay in lease revocation until we enforced a `revoke_on_unmount` flag in the Vault annotation.

The result is a system where any credential issued for a deployment is invalidated the moment the orchestrating pipeline finishes, and runtime pods hold leases that die with the pod. The audit trail in Vault now provides a direct, immutable link from a commit hash to a set of cloud permissions, and their exact lifetime. This has fundamentally shifted our security posture from reactive patching to proactive credential lifecycle management.