Why it matters
Many serious cloud incidents start with access, not clever hacking: a leaked key in a public code repository, a shared admin password, a contractor who still has access months after leaving. Banks and telcos in Ghana list identity and access management (IAM) and security controls in their cloud adverts because a single careless permission can expose customer data. This builds on accounts and access in the IT support track.
The main ideas
- Identity: who you are. A person (a user) or a program (a service identity or role).
- Authentication: proving it, with a password plus a second factor.
- Authorisation: what you are allowed to do once you are in.
- Least privilege: give each identity only the permissions it needs, for only as long as it needs them.
The root account
When you create a cloud account, the first sign in (called the root user on AWS) can do everything, including closing the account. Protect it with a strong unique password and multifactor authentication (MFA), then stop using it day to day. Create a separate admin identity for yourself and lower powered identities for everyone else.