5.1 Identity and access management

The same thing, three names

One idea, sold under a different brand by each provider. Learn it once and you can read any job advertisement.

On AWS

IAM + IAM Identity Center

On Azure

Microsoft Entra ID + Azure RBAC

On Google Cloud

Cloud IAM

Work through these

• Identities, groups, roles and policies

  Identities are who is acting, groups gather them, roles are sets of permissions, and policies are the documents that grant them. These four words are used loosely in conversation and precisely in the console, and this item pins them down.

• Least privilege in practice; starting from deny

  Least privilege means starting from nothing and adding only what is needed, which is harder than starting broad and trimming, and far more effective. The trimming version almost never happens.

• Roles for machines instead of long-lived keys

  Machines should assume a role rather than hold a long-lived key, because a role's credentials expire on their own and a stored key does not. This is the single largest improvement most accounts can make.

• Reading a permission denial and fixing the right thing

  A permission denial names what was refused, and the fix is often a different resource or condition than the one you assumed. Reading the message properly stops the habit of widening permissions until the error goes away.