Context
Cloud access is easiest to understand when every permission has an owner and a purpose. Start by listing the people, applications and automation that need access, then map the operations each one performs.
Prefer workload identities where the platform supports them. Keep runtime permissions separate from the permissions needed to provision infrastructure. Review broad permissions as systems and responsibilities evolve.
Store application secrets in an appropriate secret management system and keep them out of source control and build output. Plan how a secret can be rotated, how applications receive the new value, and who can request access.
Make access reviews part of regular operations. Remove unused credentials, review service identities and record important changes. Tools help, but clear ownership makes the controls maintainable.