> For the complete documentation index, see [llms.txt](https://security.navidnaf.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security.navidnaf.com/sky/using-cloud-resources/identity-and-access-management.md).

# Identity & Access Management

**Cloud IAM** refers to the practices, policies, and tools used to manage user identities, control access to cloud resources, and enforce security measures within a cloud computing environment.

* **User Authentication:** Verifying the identity of users accessing the system.
* **Authorization:** Determining what resources and actions users are permitted to access.
* **Permissions Management:** Assigning and managing access rights to resources based on user roles and policies.

## Root User

Has absolute full rights and control over all resources and settings within the cloud environment.

**Responsibility:** Typically used for initial setup and configuration but should be limited to minimize security risks.

## Federated User

Authenticated and authorized to access resources through a trusted external identity provider, rather than using native cloud credentials.

**Responsibility:** Provides access to cloud resources based on federated identity credentials, often used for integrating with corporate or third-party identity systems.

## Other Types

* **Cloud User:** A user with direct access to cloud resources and services.
* **Guest User:** A user with temporary or limited access to specific resources.
* **External/Hybrid User:** Users from federated systems or external entities with access through federated identities.

## Google IAM

* Users, Groups, Roles, Policies
* Federated Users
* Policies (User, Role, Resource, Condition)

<figure><img src="https://244896893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTy5fNwfsaV6DbqjnheTF%2Fuploads%2FRc0ftzgq39ggDc6QbKXD%2Fimage-2.png?alt=media&amp;token=a6e70805-c903-4472-8bfa-00c2520a421f" alt=""><figcaption></figcaption></figure>

{% embed url="<https://cloud.google.com/iam/docs/overview>" %}

{% embed url="<https://cloud.google.com/security/products/iam>" %}

## Azure AD

* Users, Groups, Roles
* Federated Users

<figure><img src="https://244896893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTy5fNwfsaV6DbqjnheTF%2Fuploads%2Fnk9IO9hXtx97x7OPZoNg%2Fimage-3.png?alt=media&amp;token=3bc71376-aff0-4561-99db-a03b2edc5223" alt=""><figcaption></figcaption></figure>

{% embed url="<https://learn.microsoft.com/en-us/entra/fundamentals/whatis>" %}

{% embed url="<https://learn.microsoft.com/en-us/azure/architecture/identity/identity-start-here>" %}

## AWS IAM

* Users, Groups, Permissions
* Federated Users
* Policies grant permissions (Effect, Action, Resources, Conditions)

<figure><img src="https://244896893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTy5fNwfsaV6DbqjnheTF%2Fuploads%2FPEI49Vjw31VgzeJwe73t%2Fimage-4.png?alt=media&amp;token=71cc4175-4f16-4405-be20-49fd1be24501" alt=""><figcaption></figcaption></figure>

{% embed url="<https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html>" %}

## Access Control

* **Minimize Privileged Access:** Limit the use of admin/root access (cloud subscription account) to reduce security risks.
* **Create Groups and Use Dynamic Management:** Organize users into groups for easier management and apply dynamic policies to adjust access as needed.
* **Security Assessments and Auditing:** Regularly assess and audit user configurations to ensure compliance with security policies.
* **Apply Least Required Rights Concept (POLP):** Grant only the minimal permissions necessary for users to perform their tasks.

{% embed url="<https://www.crowdstrike.com/cybersecurity-101/principle-of-least-privilege-polp/>" %}

## Identity & Access Flow

<figure><img src="https://244896893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTy5fNwfsaV6DbqjnheTF%2Fuploads%2FB70kLaRTxqubVgd1gHFn%2FBlank%20diagram%20-%20Page%201-9.png?alt=media&amp;token=db36ae53-9f11-49d8-814e-2df2ce34ca37" alt=""><figcaption></figcaption></figure>

## Account & Login Vulnerabilities

* **Weak Passwords:** Easily guessable or simple passwords.
* **Leaked Credentials:** Compromised or exposed login information.
* **Threat Intelligence:** Information about potential or active threats.
* **Location/IP Anomalies:** Unusual login locations or IP addresses.
* **Password Spraying:** Attempting to access accounts using common passwords.
* **Brute Force Attacks:** Automated attempts to crack passwords by trying numerous combinations.

### Best Practices

* **Strong Authentication:** Use Multi-Factor Authentication (MFA). Enforce strong password policies.
* **Access Control:** Implement role-based or conditional access control.
* **Monitoring & Review:** Monitor user activities. Regularly review user permissions and configurations.
* **Security Measures:** Use secure connection protocols and data encryption. Implement network segmentation.
* **Maintenance:** Regular systems patching. Conduct user training.
* **Account Management:** Audit and remove unused accounts.

### Response

* Revoke permissions for the compromised identity and isolate it.
* Reset session tokens, API keys, and access keys.
* Review what happened and determine the impact with IT and business colleagues.
* Remediate the issue, improve processes and action plans, and report.
* Return to normal operations and monitor.