Identity and Access Management

Identity and access management is mapping some form of an entity (a person, system, piece of code, etc.) to a verifiable identity associated with various attributes (which can change based on current circumstances), and then making a decision on what they can or can’t do based on entitlements. 

Cloud services are becoming ubiquitous in all sizes, and customers encounter many obligations and opportunities for using Identity Access Management (IAM) systems with those cloud services. However, as an area of emergent technical focus, there is little independent analysis and guidance in the public domain for addressing the intersection of IAM and cloud services. 

In cloud computing, the fundamental problem is that multiple organizations are now managing the identity and access management to resources, which can greatly complicate the process. For example, imagine having to provide the same user on dozens—or hundreds—of different cloud services. Federation is the primary tool used to manage this problem.

Other key differences are that in the cloud IAM:

These shifts also bring challenges. Moving to federation at scale with multiple internal and external parties can be complex and difficult to manage due to the sheer mathematics of all the variables involved. Determining and enforcing attributes and entitlements across disparate systems and technologies bring both process and technical issues. Even fundamental architectural decisions may be hampered by the wide variation in support among cloud providers and platforms.

IAM spans essentially every domain of cloud security. To read best practices for managing IAM in the cloud in key domains, read the CSA Security Guidance: Domain 12.