Open in app

Sign in

Write

Sign in

Managing permissions to your Cloud | Intro to Identity and Access Management | IAM

Jigar Rathod
5 min readSep 22, 2022

Lots of companies run their applications & store data in Cloud. Employees and customers of a company would also interact with the Cloud. Setting up rules and regulations around who can do what is critical.

The question

  • Who — deals with identifying the person. The username/password combination is one of the most popular ways to identify a person. Smartphones have taken it up a notch by using fingerprints and scanning faces. To call a REST endpoint, one can use an Access Key or API Key. All of these different solutions are part of an Authentication framework or Identity Management.
  • What — deals with ensuring that person-A has visibility to only allowed Cloud resources. For example, a developer may not need access to billing information. A salesperson does not need access to create a Virtual Machine. The above statements can be mapped to a rule or permission file, which can be parsed and enforced by a Cloud provider. Management and enforcement of permissions are part of an Authorization framework or Access Management.

Combine both of the concepts together, and you get Authentication and Authorization or Identity and Access Management (IAM). Here is a list of some of the popular IAM tools (from Gartner’s market review)

  • Okta SSO — Auth0
  • Microsoft Azure Active Directory
  • PingOne Cloud Platform
  • Cisco Duo Access

Important Terminologies

Assume that person-X is trying to create/delete/access a Virtual Machine. Cloud Provider would check the permissions using the IAM component to find out, “Should person-X create/delete/access a Virtual Machine?”. In this example,

  • Person-X is known as a Principal
  • Virtual Machine is a resource in the Cloud
  • Create/delete/access is an action or operation

In the case of IAM, permissions are created. Example of permissions:

  • Create/delete/access a VM with specific configuration
  • Allow read-only access to database-A
  • Deny access to the super-secret database

These permissions can be grouped into a policy which can be attached to a user.

What if person-X needs ten people to work on a project? Instead of attaching a policy for each user, one can

  • create a user-group for person-X’s team
  • attach policy to the user-group
  • add users to the user-group

Side-note

It is essential to take time while defining permissions. One should ideally follow the principle of least privilege, which states that a user should be given the least amount of permissions. Add more permissions later on if needed.

Identity and Access Management in AWS

In the case of AWS, IAM is a dedicated module. One can define policies and permissions using IAM.

A screenshot of sample permissions from AWS Console

IAM can also assist with

  • Onboarding a user
  • Add user to a group
  • Attach permissions to the group or user or both
A screenshot of the user creation screen from the AWS console

Consider the following scenario: user-X is part of group-A and group-B.

  • Group-A has a policy that allows create a VM action & access a database
  • Group-B has a policy that denies create a VM action

What would you do if user-X wants to create a VM, access database, and create a subnet?

As one policy allows VM creation, but the other does not. When user-X tries to create a VM, the action should be denied. User-X should be able to access a database. As none of the policies linked to User-X states anything for create a subnet action, it should be denied. IAM follows the same logic.

  • deny an action if any policy linked to a user has a deny permission
  • allow an action only if any policy linked to the user explicitly has an allow permission
  • deny otherwise

In this post, we looked at lots of different key concepts, such as

  • Authentication, Authorization
  • Identity & access management
  • Principle — Resource — Action
  • Permission — Policy
  • User-group
  • Principle of least privilege
  • What to do when one policy denies an action, but another policy allows it?

References

Blogs

Videos

Image

AWS
Identity Management
Access Management
Iam Roles
Aws Cloud

--

--

Jigar Rathod

Written by Jigar Rathod

13 Followers

DevOps Engineer and a part time investor | feel free to reach out to me | LinkedIn — https://www.linkedin.com/in/jigarrathod/

Help

Status

About

Careers

Press

Blog

Privacy

Terms

Text to speech

Teams