Most vendor-provided software today is delivered as a cloud-based SaaS solution: hosted on AWS, Microsoft Azure, or Google Cloud. This creates an interesting challenge for your Zero Trust program: the cloud service provider is a fourth party, not a third party. You can't audit them directly. but you can and must evaluate whether your vendors are using the cloud platforms' Zero Trust capabilities effectively.
The Fourth-Party Complication
When a vendor runs their SaaS on AWS, your security posture depends not just on your vendor's controls, but on how they've configured the underlying cloud environment. The good news: the major cloud providers have published extensive Zero Trust implementation guidance. The framework for evaluation is: does your vendor know these capabilities exist, have they deployed them, and do they have processes to maintain them?
Zero Trust on AWS
AWS takes a dual approach: identity-centric and network-centric controls working together.
Key capabilities to ask vendors about: - Security Groups: Dynamic, software-defined network perimeters for EC2 deployments that control both north-south and east-west traffic - AWS PrivateLink: Private connectivity between VPCs without exposing traffic to the public internet - Amazon API Gateway: Provides DDoS protection, rate limiting, and IAM-based authorization for API calls, signed with TLS encryption - Amazon WorkSpaces/AppStream/WorkLink: Secure virtual desktop and application delivery options for different use cases
Ask your AWS-hosted vendors specifically about their use of security groups, PrivateLink, and whether they've implemented AWS Shield, AWS WAF, and OpenID Connect for any self-hosted components.
Zero Trust on Azure
Microsoft structures Azure Zero Trust around three principles: verify explicitly, use least privilege access, and assume breach. Key architectural components:
• Azure Active Directory with RBAC: Fine-grained identity-based access control using Conditional Access Policies and Shared Access Signatures (SAS)
• Azure Defender for Cloud / Azure Monitor: Extended detection and response across the environment
• Private Endpoint and Private Link: Network microsegmentation preventing public data access
• Resource Group Isolation: Separate resource groups for VMs, storage, networks, and security to enforce separation of duties
For vendors using Azure, walk through whether they've implemented Zero Trust controls across the four architectural areas: Storage, Virtual Machines, Spoke VNets, and Hub VNets.
Zero Trust on Google Cloud
Google pioneered enterprise Zero Trust with its internal BeyondCorp initiative, born from a 2009 breach. Their cloud offering translates this into two primary tools:
• Identity-Aware Proxy (IAP): Establishes central identity awareness for all HTTPS and TCP-accessible resources, enabling per-resource access control without network-layer firewalls
• Access Context Manager: Allows vendors to define granular access levels based on IP subnet, geographic region, device policy, and user identity
Once a vendor has correctly implemented both IAP and Access Context Manager, Google considers the application protected by BeyondCorp Enterprise.
Key Takeaway: You can't audit AWS, Azure, or Google, but you can absolutely audit whether your vendors are using these platforms' Zero Trust capabilities. The major CSPs have published clear roadmaps; your job is to verify that your vendors are following them.
Tags: Cloud Security | AWS | Azure | Google Cloud | SaaS | Fourth-Party Risk | Zero Trust
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Which of your vendors are critical?
The free eight-step vendor checklist: sort your vendors into systemically critical, critical or ordinary.
Get the checklist →Privileged access
The free VAULTS™ training: 31 minutes on privileged access review, with a worked review.
Get the free training →