Detecting stealing of principals in a cloud environment

A method comprising:

• receiving a request for a non-user principal to be used within a cloud environment;
• accessing a log that includes information associated with a receipt of the request for the non-user principal;
• determining, based at least in part on the log, originating information of the request;
• detecting an anomaly associated with the originating information of the request;
• and
• in response to detecting the anomaly associated with the originating information of the request, causing to present information indicative of the detected anomaly associated with the originating information of the request.

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing instructions, which, when executed by the system, cause the system to perform a set of actions including:
• receiving a request for a non-user principal to be used within a cloud environment;
• accessing a log that includes information associated with a receipt of the request for the non-user principal;
• determining, based at least in part on the log, originating information of the request;
• detecting an anomaly associated with the originating information of the request;
• and
• in response to detecting the anomaly associated with the originating information of the request, causing to present information indicative of the detected anomaly associated with the originating information of the request.