IAM - Authentication, Federation, Least Privilege, and Workload Identity
What this domain covers
Identity and Access Management is the control plane of modern environments and a frequent source of real breaches. The exam tests authentication versus authorization, federation protocols, access models, privileged access, secrets handling, non-human identities in pipelines, and zero trust as an architectural stance.
Core rules
- Authentication establishes who; authorization decides what. Mixed-up answers are the most common IAM error.
- MFA everywhere, with phishing-resistant FIDO2/WebAuthn preferred for administrators and developers. Single sign-on centralizes policy and revocation.
- Federation: SAML 2.0 for enterprise web SSO, OIDC for modern applications and APIs. OAuth 2.0 is a delegation framework for authorization, not an authentication protocol; use OIDC when you need identity.
- Access models: RBAC assigns permissions to roles, ABAC evaluates attributes, ReBAC evaluates relationships. Policy engines such as OPA let you express and test these as code.
- Least privilege with just-in-time elevation and privileged access management; no standing administrator rights. Break-glass accounts exist, are monitored, and are tested.
- Workload identity replaces stored secrets: CI federates to the cloud via OIDC and receives a short-lived role session scoped to repository and branch; SPIFFE/SPIRE issues workload identities; Kubernetes service accounts use audience-bound projected tokens.
- Secrets management: central vault, dynamic short-lived credentials, rotation, no secrets in git or image layers, secret scanning as a backstop rather than a strategy.
- Lifecycle hygiene: joiner-mover-leaver processes, periodic access reviews, detection of orphaned and dormant accounts.
- Zero trust (NIST SP 800-207): no implicit trust from network location, per-request evaluation, policy decision and enforcement points, assume the network is hostile.
Worked example
A CI pipeline stores a long-lived cloud access key in repository secrets, rotated annually. Reasoning: the key works from anywhere, never expires, and leaks through logs, forks or a compromised dependency; blast radius is the whole account. The fix removes stored keys entirely: the CI provider is trusted via OIDC, the cloud role trusts only that repository and protected branch, the session lasts minutes, and permissions are scoped to the deployment target. Secret scanning remains as a backstop. A stolen token now expires quickly and cannot be replayed outside the workflow.
Traps that cost marks
- Calling OAuth 2.0 an authentication protocol.
- Letting roles accumulate permissions until everyone is effectively admin.
- Service accounts with permanent admin rights and no owner.
- Enforcing MFA for humans while leaving pipeline and break-glass paths unprotected.
- Treating VPN or network location as proof of trust.