1 Introduction
In keeping with the transformational change that is occurring as increased digitalisation impacts all industry sectors, AWS has extended the identity management features of their cloud platform. This allows customers to enhance their business processes, it lets them identify users who are accessing corporate facilities and it reduces cybersecurity risk by enabling better access control.
Whether you are using public cloud facilities, or a hybrid configuration, the AWS platform can now accommodate most access control needs. The AWS identity and access management (IAM) facilities provide greater granularity in assigning entitlements which allows better management of access control to applications and protected resources in the AWS environment. Users can deploy the appropriate level of identity management granularity to allow administration of a cloud environment to be adequately segmented. For instance, it is highly advisable to segment server access, database access, key management and backup services. AWS identity management services facilitates achieving this level of segmentation. Software development can also be better managed with the ability to control access to dev, test and prod environments.
Organizations take different approaches to access control. A common practice is to assign roles based on group membership i.e. if someone is an AD administrator, they will be put in the ‘AD admin’ group. Other organizations prefer to establish a directory OU (organizational unit); applications then verify that a user’s ID is in the associated OU before granting access to a user request. Increasingly user attributes are used to control access to systems i.e. only staff with a department attribute of “Finance” will get access to the financial management application.
To accommodate the widest possible number of use cases AWS provides both role assignments, whereby the permissions of a “role” can be granted to a user by assigning the role to them, or group assignments, whereby a user with a specific group membership is assigned the entitlements of that group.
Federation is also supported for access to AWS facilities. AWS is fully SAML 2.0 compliant and can provide SSO to the AWS management console for a user with an appropriate record in a trusted third-party identity provider (IdP) service. Federation can be used for API security management; this is particularly useful when third-party users must access an application via an AWS API.
Key management has been improved. Clients of AWS can choose to use the key management functionality provided within the platform or they or they can bring their own CustomerMaster Key to the AWS platform. The AWS key management functionality will satisfy the confidentiality requirements for most clients, but in regulatory environments that mandate customer-based key management, that option can be accommodated.
Managing identities is core functionality for a cloud platform. It is necessary for clients to be able to protect their cloud infrastructure and ensure appropriate access control to system features. The AWS platform enables customers to achieve this via a functional user interface.
