CoreQ Academy4.3 Given a scenario, implement identity and access management.
Identity is the main cloud perimeter. Secure the management plane, the workloads, and how people and programs authenticate and are authorised.
Secure access to the cloud management environment
- Programmatic access
- Access through code and tools rather than a browser; use short-lived credentials and roles, not long-lived keys.
- Application programming interface (API)
- Direct API calls to the provider, authenticated with signed requests or tokens.
- Software development kit (SDK)
- Language libraries that wrap provider APIs and handle credentials.
- Common Language Infrastructure (CLI)
- Command-line tools for managing cloud resources; protect their stored credentials.
- Web portal
- The browser console; enforce MFA and SSO.
Secure access to the cloud resources
- API (resources)
- Protect workload APIs with authentication, authorisation and rate limits.
- Secure Shell (SSH)
- Encrypted remote access to Linux; use keys or certificates, not passwords, and restrict sources.
- Remote Desktop Protocol (RDP)
- Remote access to Windows; never expose it directly to the internet.
- Bastion host
- A hardened jump host (or managed bastion service) that is the only path to private instances, with logging.
Authentication models
- Local users
- Accounts that exist only in one system; hard to manage at scale.
- Federation
- Trusting an external identity provider so users sign in with corporate identities.
- Security Assertion Markup Language (SAML)
- XML-based federation standard common for console SSO.
- Token-based
- Short-lived tokens (JWTs, session tokens) instead of passwords on each request.
- Directory-based
- Authentication against a central directory such as Active Directory or LDAP.
- Multifactor authentication (MFA)
- Two or more factor types; mandatory for privileged and console access.
- OpenID Connect
- Identity layer on OAuth 2.0 used for modern SSO and for workload federation (e.g. CI pipelines getting cloud credentials without stored keys).
Authorization models
- Role-based access control
- Permissions grouped into roles assigned to users or workloads.
- Group-based access control
- Permissions assigned to groups; users inherit them by membership.
- OAuth 2.0
- Delegated authorisation framework issuing access tokens with scopes.
- Discretionary
- Resource owners decide who gets access.
Accounting
- Audit trail
- Logs of who did what and when in the cloud control plane (e.g. CloudTrail, Activity Log). Enable in every account and protect from tampering.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.3 of the publicly available CompTIA Cloud+ CV0-004 exam objectives (Exam objectives V4, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.