Cloud Identity and Access Management
Cloud identity and access management controls who and what can access resources across cloud platforms. It defines identities, assigns permissions through policies, enforces least privilege, and provides the authentication and authorization layer for every cloud API call.
itCloud computing | OpenSkills.info
Intro
Cloud Identity and Access Management
Cloud identity and access management, or IAM, controls access to cloud resources. It answers four linked questions:
- Who or what is requesting access?
- How does the system verify that identity?
- What action may that identity perform on which resource?
- What evidence records the decision and resulting activity?
IAM is the control plane between identities and resources. A strong design gives each identity enough access for its work, for only as long as needed. A weak design can turn one stolen credential into broad access across an environment.
The central mental model
Think of an access decision as a sentence:
A principal may perform an action on a resource when the request meets specified conditions.
- Principal: a human, workload, device, or external identity making a request
- Action: an operation such as reading an object or changing a network policy
- Resource: the protected object, service, project, account, or subscription
- Condition: context such as time, device state, network, authentication strength, or resource attributes
Authentication establishes confidence in an identity. Authorization decides what that authenticated identity may do. These are separate controls. A successful sign-in does not imply permission to every resource.
Cloud providers express the model with different policy languages and names. The stable questions remain the same: principal, action, resource, and condition.
Identity types
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://pages.nist.gov/800-63-4/
Supports
- Current Revision 4 structure for identity proofing, authentication, and federation
- Risk-based digital identity controls and continuous evaluation
- https://pages.nist.gov/800-63-4/sp800-63/introduction/
Supports
- Identity, authentication, and federation assurance concepts
- Scope of digital identity risk management
- https://pages.nist.gov/800-63-4/sp800-63b.html
Supports
- Authentication and authenticator management terminology
- Multi-factor and phishing-resistant authentication concepts
- https://pages.nist.gov/800-63-4/sp800-63c.html
Supports
- Federation roles, assertions, relying parties, and trust agreements
- Local relying-party responsibility after federation
- https://pages.nist.gov/zero-trust-architecture/VolumeB/ZeroTrustTakeaways.html
Supports
- Default denial, least privilege, separation of duties, and contextual policy
- Resource discovery, policy validation, and continuous review
- https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
Supports
- Workforce federation and temporary credentials
- Workload roles instead of long-lived credentials
- Multi-factor authentication, least privilege, conditions, and access analysis
- Removal of unused identities, roles, permissions, policies, and credentials
- https://docs.cloud.google.com/iam/docs/overview
Supports
- Principal, role, permission, resource, and allow-policy model
- Resource hierarchy and inherited policy scope
- Conditions, deny policies, boundaries, and temporary privileged access
- https://learn.microsoft.com/en-us/entra/identity/conditional-access/plan-conditional-access
Supports
- Contextual access signals and policy decisions
- Staged policy deployment, exclusions, emergency access, and temporary privilege
- https://openid.net/developers/how-connect-works/
Supports
- OpenID Connect as an authentication protocol based on OAuth
- Identity provider, relying party, identity token, and claims terminology
- https://www.rfc-editor.org/info/rfc6749
Supports
- OAuth as an authorization framework
- Access tokens as scoped and time-bound authorization credentials
- Separation between client authorization and resource-owner credentials
- https://www.cisa.gov/sites/default/files/2023-12/ESF%20IDENTITY%20AND%20ACCESS%20MANAGEMENT%20RECOMMENDED%20BEST%20PRACTICES%20FOR%20ADMINISTRATORS%20PP-23-0248_508C.pdf
Supports
- Identity lifecycle, governance, privileged access, and administrator practices
- Logging, monitoring, and IAM threat mitigation