MEPX
Chapter 7 of 10All chapters
  1. 1What the cloud is
  2. 2Service models
  3. 3Compute
  4. 4Storage and data
  5. 5Regions and zones
  6. 6Cloud networking
  7. 7Identity and access
  8. 8Cost
  9. 9Infrastructure as code
  10. 10Running things

Chapter 7 of 10

Identity and access

Who may do what.

Roles over keys

Long-lived access keys leak. Roles grant temporary credentials to a machine or service, which expire on their own and cannot be pasted into a repository.

  • Grant the minimum permissions and widen only when something breaks.
  • Turn on multi-factor authentication for every human account, especially the root one.

The common breach

Most cloud incidents are not exotic: a public storage bucket, an over-permissive role, or a key committed to a repository. All three are configuration, not software flaws.