Abstract: The present disclosure describes solutions to a confused identity security vulnerability that can arise during multicloud operations. In an example method, a second cloud environment receives, from a first cloud environment, a request to perform an operation involving a service manager for a cloud service offered in the second cloud environment. The request can include a first identifier and a URL. The second cloud environment outputs a network request to a network location identified by the URL. The second cloud environment receives a response including a second identifier, which it compares to the first identifier. Upon determining, based upon the comparing, that the second identifier matches the first identifier, the second cloud environment performs processing enable performance of the operation involving the service manager. Upon determining that the second identifier does not match the first identifier, the second cloud environment rejects the request to perform the operation.

Abstract: A multi-cloud control plane of a source cloud environment receives from a control plane of a target cloud environment, a first request for accessing a service provided in the source cloud environment, the first request including a plurality of identifiers that enable identifying a first set of resources in the target cloud environment that are allocated to a customer. A first identifier is extracted from the plurality of identifiers included in the first request. Responsive to validating the first identifier, the multi-cloud control plane obtains a resource principal session token (RSPT), and information related to a second set of resources in the source cloud environment that are allocated to the customer. The multi-cloud control plane triggers the service provided in the source cloud environment based on the RSPT, wherein the service deploys service-based resources based on the second set of resources in the source cloud environment.

Abstract: Techniques for spending limits in a cloud computing network are disclosed. The system receives a usage request in a cloud computing network for a user. The user having a customer tenancy in the cloud computing network including cloud computing resources. The system determines a cloud computing usage increase value relative to a time frame (such as a day) using at least the usage request. The system determines whether the cloud computing usage increase value exceeds a threshold. Based on determining that the cloud computing usage increase value exceeds the threshold, the system performs a remediation action. The remediation action comprises at least one of rejecting the usage request and bypassing the threshold.

Abstract: Techniques including receiving, by a cloud environment of a cloud service provider, a requested resource usage for a resource associated with a subscription of a user account with the cloud service provider. The techniques further include determining, as part of managing resources at a subscription level independent of managing resources at a user account level, a resource usage by the subscription. The techniques further include determining that a usage limit for the resource is greater than the resource usage. Based on the usage limit being greater than the resource usage, the techniques further include determining that a remaining resource allocation for the subscription is greater than or equal to the requested resource usage. Based on the remaining resource allocation being greater than or equal to the requested resource usage, the techniques further include providing the resource to the user account and updating the resource usage.

Abstract: Technologies are provided for prevention of organizational data leakage across platforms based on device status. A device management service may include status information for a client device and/or a connection in a token provided to the client device and update the status in response to changes. An applicable data protection policy may be determined based on the detected status and optionally based on data being accessed. An instruction may be transmitted to a client application executed on the client device based on the applicable data protection policy thereby enforcing the data protection policy at the server. The instruction may cause a script executed at the client application to disable one or more user interface controls associated with functionality such as downloading, synchronizing, printing, etc. of the organizational data to prevent leakage of organizational data.

Abstract: Technologies are provided for prevention of organizational data leakage across platforms based on device status. A device management service may include status information for a client device and/or a connection in a token provided to the client device and update the status in response to changes. An applicable data protection policy may be determined based on the detected status and optionally based on data being accessed. An instruction may be transmitted to a client application executed on the client device based on the applicable data protection policy thereby enforcing the data protection policy at the server. The instruction may cause a script executed at the client application to disable one or more user interface controls associated with functionality such as downloading, synchronizing, printing, etc. of the organizational data to prevent leakage of organizational data.