Identity & Access Management
Identity is the new perimeter
Cover the identity lifecycle (joiner, mover, leaver, with deprovisioning as the perennial exam answer), authentication, authorization, federation and single sign-on, multi-factor authentication, privileged access management, just-in-time elevation, secrets management, and role-based versus attribute-based access control. SAML and OpenID Connect handle authentication and federation; OAuth 2.0 is a delegated authorization framework. Cloud-native additions include entitlement analysis and permission boundaries.
Cloud-specific realities
Root, global administrator, and organization-owner accounts should be locked away with hardware MFA and break-glass procedures, never used for daily work. Workloads should use managed identities, instance profiles, or role assumption rather than embedded long-lived keys. A cloud policy statement is evaluated on principal, action, resource, and condition, with explicit deny typically winning. Separation of duties, scoped roles, and temporary credentials are the default posture.
Federation versus synchronization
Directory synchronization copies identities (and often password hashes) into the cloud. Federation trusts tokens and keeps authentication at the identity provider. When a question asks how to reduce credential sprawl or preserve a single authoritative directory, federation is the answer.
Traps
- OAuth 2.0 is authorization; OpenID Connect is the authentication layer.
- Encryption is not an access control; key access is the control.
- Roles with reassuring names are often far broader than they sound.
- MFA on the root account does not remove the need for least privilege.
Rule of thumb
Log in as root only to establish the break-glass process and the first administrator; everything else should be a federated role with conditions attached.