A Role-Based Access Control Model for Multi-Cloud Data Pipelines: Governance and Compliance Perspective

The rapid adoption of multi-cloud architectures has introduced significant complexity in managing secure and compliant access to data pipelines that span diverse cloud platforms. Traditional Role-Based Access Control (RBAC) models, while effective in isolated systems, struggle to provide unified and governance-compliant access control across heterogeneous cloud environments. This paper proposes a layered, compliance-aware RBAC model designed specifically for multi-cloud data pipelines. The model introduces a role abstraction layer, policy harmonization mechanisms, and identity federation to enable consistent role definitions and cross-platform enforcement. Decoupling organizational roles from platform-specific configurations ensures scalable and auditable access control while maintaining the principle of least privilege. The model integrates seamlessly with native cloud tools such as AWS IAM, Azure RBAC, and Google Cloud IAM, and aligns with enterprise Identity and Access Governance (IAG) frameworks. It supports onboarding, role lifecycle management, policy translation, and continuous auditing to meet stringent regulatory requirements such as GDPR, HIPAA, and SOX. Practical implementation considerations and mitigation strategies are also discussed, addressing challenges such as role explosion, policy conflict, and trust boundary management. Finally, the paper explores future research directions, including dynamic access control extensions and zero-trust architecture integration. This RBAC framework provides both theoretical grounding and operational guidance for securing data pipelines in complex, regulated multi-cloud ecosystems.