Multi-cloud Kubernetes at scale (AWS + Azure simultaneously) is one of those setups where IAM boundaries and secrets management tend to drift faster than the team realizes — each cloud has its own identity model and they don't map cleanly to each other, so the blast radius from a misconfigured service account is usually larger than anyone expects.

Worth doing a security pass on the existing setup before new platform engineers inherit it as the baseline. Distributed teams expanding across regions amplify this fast.

Happy to talk through the infra security side if useful — this is the kind of work I do with teams at this stage.