The alarms hit at 02:37. A critical account in the primary cloud was compromised. The attacker didn’t have full admin—just enough clustered database permissions to bypass logging and drain data. Multi-cloud security breaks when roles are too broad, too vague, or too inconsistent across platforms.
A multi-cloud platform is only as strong as the weakest privilege configuration in its network. Granular database roles let you split duties, isolate actions, and enforce least privilege without blocking legitimate work. In AWS, Azure, and GCP, this means defining precise role scopes at the resource level, binding them to service accounts, and auditing them with unified policies.
For engineering teams running workloads across multiple providers, the first rule is to avoid default roles. Create custom IAM profiles per database, per region, per cluster. Align them with application-level access controls. This prevents permission creep, keeps roles portable between clouds, and ensures compliance rules apply everywhere.
Granular roles should cover actions like read, write, modify schema, manage backups, and adjust indexes. Tie each to separate task boundaries, then map them directly to user identities or service accounts. Avoid cross-role overlaps that grant silent superuser rights. In PostgreSQL or MySQL instances hosted on different clouds, replicate the role logic exactly, using provider-native IAM to back it.