Size each workload, match replicas to demand, and give those replicas somewhere to run.
In AWS, a role is an assumable identity with attached permissions. In GCP, a role is a permission bundle; principals receive roles through IAM bindings, and workloads execute as service accounts.
When translating controls between the two clouds, map the trust path separately from the permission set. Similar names do not imply equivalent identity boundaries.
IAM Policy Simulator evaluates requested actions against a principal's policies without making the API call itself. Use it as a preflight check for high-risk policy changes, then verify the same path in a non-production account.
aws iam simulate-principal-policy \
--policy-source-arn arn:aws:iam::123456789012:role/workload \
--action-names s3:GetObject“And in a sunless realm, the sun rose at last.”