Identity & Access Management

Cloud IAM refers to the practices, policies, and tools used to manage user identities, control access to cloud resources, and enforce security measures within a cloud computing environment.

• User Authentication: Verifying the identity of users accessing the system.

• Authorization: Determining what resources and actions users are permitted to access.

• Permissions Management: Assigning and managing access rights to resources based on user roles and policies.

Root User

Has absolute full rights and control over all resources and settings within the cloud environment.

Responsibility: Typically used for initial setup and configuration but should be limited to minimize security risks.

Federated User

Authenticated and authorized to access resources through a trusted external identity provider, rather than using native cloud credentials.

Responsibility: Provides access to cloud resources based on federated identity credentials, often used for integrating with corporate or third-party identity systems.

Other Types

• Cloud User: A user with direct access to cloud resources and services.

• Guest User: A user with temporary or limited access to specific resources.

• External/Hybrid User: Users from federated systems or external entities with access through federated identities.

Google IAM

• Users, Groups, Roles, Policies

• Federated Users

• Policies (User, Role, Resource, Condition)

IAM overview  |  Identity and Access Management (IAM)  |  Google Cloud DocumentationGoogle Cloud Documentation

Identity and Access Management documentation  |  Identity and Access Management (IAM)  |  Google Cloud DocumentationGoogle Cloud Documentation

Azure AD

• Users, Groups, Roles

• Federated Users

What is Microsoft Entra? - Microsoft EntraMicrosoftLearn

Identity architecture design - Azure Architecture CenterMicrosoftLearn

AWS IAM

• Users, Groups, Permissions

• Federated Users

• Policies grant permissions (Effect, Action, Resources, Conditions)

IAM Identities - AWS Identity and Access ManagementAWS Identity and Access Management

Access Control

• Minimize Privileged Access: Limit the use of admin/root access (cloud subscription account) to reduce security risks.

• Create Groups and Use Dynamic Management: Organize users into groups for easier management and apply dynamic policies to adjust access as needed.

• Security Assessments and Auditing: Regularly assess and audit user configurations to ensure compliance with security policies.

• Apply Least Required Rights Concept (POLP): Grant only the minimal permissions necessary for users to perform their tasks.

What is Principle of Least Privilege (POLP)? | CrowdStrikeCrowdStrike.com

Identity & Access Flow

Account & Login Vulnerabilities

• Weak Passwords: Easily guessable or simple passwords.

• Leaked Credentials: Compromised or exposed login information.

• Threat Intelligence: Information about potential or active threats.

• Location/IP Anomalies: Unusual login locations or IP addresses.

• Password Spraying: Attempting to access accounts using common passwords.

• Brute Force Attacks: Automated attempts to crack passwords by trying numerous combinations.

Best Practices

• Strong Authentication: Use Multi-Factor Authentication (MFA). Enforce strong password policies.

• Access Control: Implement role-based or conditional access control.

• Monitoring & Review: Monitor user activities. Regularly review user permissions and configurations.

• Security Measures: Use secure connection protocols and data encryption. Implement network segmentation.

• Maintenance: Regular systems patching. Conduct user training.

• Account Management: Audit and remove unused accounts.

Response

• Revoke permissions for the compromised identity and isolate it.

• Reset session tokens, API keys, and access keys.

• Review what happened and determine the impact with IT and business colleagues.

• Remediate the issue, improve processes and action plans, and report.

• Return to normal operations and monitor.