Secure resource access management using stacked resource principal identities

A system comprising:

• a memory;
• and
• one or more processors configured to perform processing, the processing comprising:
• obtaining, for a first resource, a first identity associated with the first resource, the first resource provisioned in a first tenancy of a plurality of tenancies provided by a cloud service provider infrastructure (CSPI);
• obtaining, for the first resource, a first token for the first resource, the first token enabling the first resource to assert its first identity;
• executing, for the first resource, a set of instructions to obtain a second identity associated with second resource upon which the first resource is built, the second resource residing is a second tenancy of the plurality of tenancies provided by the CSPI;
• obtaining, for the first resource, the second identity associated with the second resource, the second identity associated with the second resource obtained by validating stack mapping information that identifies a mapping between a resource identifier of the second resource and a resource identifier of the first resource;
• obtaining, for the first resource, a second token for the first resource, the second token enabling the first resource to assert its second identity;
• and
• using, by the first resource, the second token to access one or more other resources, wherein the one or more other resources reside in the second tenancy of the plurality of tenancies provided by the CSPI.

A non-transitory computer-readable medium storing instructions executable by a computer system that, when executed by one or more processors of the computer system, cause the one or more processors to perform operations comprising:

• obtaining, for a first resource, a first identity associated with the first resource, the first resource provisioned in a first tenancy of a plurality of tenancies provided by a cloud service provider infrastructure (CSPI);
• obtaining, for the first resource, a first token for the first resource, the first token enabling the first resource to assert its first identity;
• executing, for the first resource, a set of instructions to obtain a second identity associated with second resource upon which the first resource is built, the second resource residing is a second tenancy of the plurality of tenancies provided by the CSPI;
• obtaining, for the first resource, the second identity associated with the second resource, the second identity associated with the second resource obtained by validating stack mapping information that identifies a mapping between a resource identifier of the second resource and a resource identifier of the first resource;
• obtaining, for the first resource, a second token for the first resource, the second token enabling the first resource to assert its second identity;
• and
• using, by the first resource, the second token to access one or more other resources, wherein the one or more other resources reside in the second tenancy of the plurality of tenancies provided by the CSPI.