Security, Access Control, and Compliance
This section covers Security, Access Control, and Compliance: authentication, RBAC roles, local and directory users, cluster lockdown, encryption, certificates, and audit evidence.
Access control rules
- Prism supports local users and directory authentication such as Active Directory or LDAP. Map directory groups to roles carefully.
- RBAC should follow least privilege. A viewer role is not an administrator role, even if the user can see many objects.
- Cluster lockdown restricts access to management interfaces and should be planned so support and automation still work.
- Data-at-rest encryption depends on key management; losing key access can make data unrecoverable.
- Audit logs and configuration records support compliance evidence. Certificate expiry is an operational security issue.
Worked example
An auditor needs read-only visibility into cluster health and VM inventory. Assign a Prism viewer role through a directory group rather than sharing the local admin account. The auditor can inspect objects and alerts but cannot change configuration. If the auditor also needs API read access, confirm the role permits that API path; do not grant admin to avoid testing permissions.
Traps that cost marks
Do not share local admin credentials as a convenience. Do not assume authentication equals authorization. Do not enable lockdown without validating support and automation access. Do not treat encryption as complete without key management and recovery planning.