Y

Library · concept

Identity and access management

Decide who can do what to which resource: least-privilege policies, roles with temporary credentials, explicit denies, and identities for machines as well as people.

Identity and access management appeared in 22% of the DevOps job descriptions we read, and it is central to cloud and security roles. Most cloud breaches involve credentials or permissions that were broader than they needed to be.

The examples use AWS IAM policy syntax. They run locally against moto, a library that emulates AWS and, in the mode used here, enforces IAM policies, so every "allowed" and "denied" below was produced by evaluating the policy. The concepts map directly to Azure role assignments and Google Cloud IAM.

  1. 1Least privilege in practiceLeast-privilege policies you can test4 min read
  2. 2Least privilege in practiceRoles, temporary credentials and explicit deny4 min read

Identity and access management lessons

Loading lessons…