Authenticating cloud services

A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for authenticating cloud services, the method comprising:

• receiving a request for a credential from a compute instance executing in a cloud computing environment, wherein the request comprises a first set of metadata specific to the compute instance;
• wherein the credential is associated with a compute role;
• wherein the method further comprises denying the compute instance access to the credential when a second compute role associated with the credential key does not match the compute role of the compute instance;
• tracking the credentials that have been requested by and granted to the compute instance;
• determining anomalous requests from the compute instance;
• querying a management interface for the cloud computing environment to retrieve a second set of metadata specific to the compute instance;
• and
• upon determining that the first set of metadata matches the second set of metadata, granting the credential to the compute instance.

A computing device configured to authenticate cloud services, comprising:

• a processor;
• a memory;
• a receiving mechanism configured to receive a request for a credential from a compute instance executing in a cloud computing environment, wherein the request comprises a first set of metadata specific to the compute instance;
• wherein the credential is associated with a compute role;
• a denying mechanism to deny the compute instance access to the credential when a second compute role associated with the credential key does not match the compute role of the compute instance;
• a tracking mechanism configured to track the credentials that have been requested by and granted to the compute instance;
• a determining mechanism configured to determine anomalous requests from the compute instance;
• a querying mechanism configured to query a management interface for the cloud computing environment to retrieve a second set of metadata specific to the compute instance;
• wherein the determining mechanism is further configured to compare the first set of metadata with the second set of metadata;
• and
• wherein the determining mechanism is further configured to grant the credential to the compute instance if the first set of metadata matches the second set of metadata.