Security, Identity, and Access Control
Security questions test identity plumbing, authorization scope and hardening: who can log in, what they can do, and how the platform is locked down.
Identity
- Authentication sources include local users, Active Directory/LDAP directory services and SAML SSO. Directory integration is configured once and consumed at the Prism Central tier for registered clusters.
- Use role-based access control with users or directory groups; custom roles are assembled from permission lists. Scope access with projects so a team sees only its own VMs and networks.
Hardening
- Cluster lockdown disables SSH and console access for the nutanix account and forces Prism/API access - useful, but it breaks any script that relies on SSH to the CVM.
- Replace default self-signed certificates, enforce password policy, rotate API keys and review the audit log.
- Data-at-rest encryption uses self-encrypting drives plus a key management server; losing the KMS means losing the data, so protect it accordingly.
Worked example
An auditor needs read-only visibility of one project's VMs for 30 days. Create an AD group, assign a viewer-equivalent role scoped to that project, add the auditor to the group, and confirm in Prism that the project filter shows only the intended VMs. Reasoning: cluster-wide admin exceeds least privilege, and scoping by project plus directory group makes the access time-limited and auditable.
Traps
- Granting admin because a viewer role "might not show enough".
- Applying identity changes at the wrong tier - a PE registers to only one Prism Central, so RBAC belongs there.
- Enabling cluster lockdown and then discovering automation depends on SSH.
- Treating Flow microsegmentation as a substitute for authentication and RBAC; it controls network flows, not users.