Identity, Access, and Security Management
Two control planes
NC2 has two identity surfaces. AWS IAM controls who can deploy and manage the underlying AWS resources. Prism Central controls who can log in to Nutanix, create VMs, change networks, and view alerts. Do not confuse them: an AWS administrator is not automatically a Prism administrator, and a Prism project user does not need AWS console rights.
Prism Central access
- Integrate Active Directory or LDAP, then map AD groups to Prism roles. Use SAML SSO where the identity provider supports it.
- Apply least privilege: Viewer for read-only operations, project-scoped roles for tenant teams, full admin only for platform staff.
- Use projects and categories to separate VM ownership and quota. Flow Network Security can then apply microsegmentation policies by category rather than by IP.
AWS side
The NC2 deployment role should be a dedicated IAM role assumed through CloudFormation, with only the permissions NC2 needs. Protect the role with MFA and change control. Security groups and NACLs remain the outer network control; Prism RBAC is the inner workload control.
Worked example
A security team wants auditors to see alerts but not change VMs. Integrate AD, create an "NC2-Auditors" group, assign the Prism Viewer role at the Prism Central scope, and give no AWS IAM permissions. The auditors log in with AD credentials and can read dashboards but cannot power off a VM.
Traps
Using a shared local admin; granting AWS AdministratorAccess to the NC2 role; assuming AD group changes apply instantly without re-login; using security groups as a substitute for microsegmentation.