Search
5 results for “access-control”
Search results
Cloud IAM Fundamentals
How identity, roles, and policies fit together across cloud providers, why least-privilege is a discipline rather than a one-time setup, and the difference between authentication and authorization.
What is the difference between authentication and authorization in a cloud IAM context?
Authentication answers "who is making this request", verifying an identity via credentials, a token, or a federated login. Authorization answers "is this identity allowed to do this specific action on this specific resource", evaluated after authentication succeeds, by checking the identity's attached policies against the requested action. A request can be perfectly authenticated (the caller genuinely is who they claim) and still be denied, because authorization is a separate check against what that identity is actually permitted to do.
What does the principle of least privilege mean in practice, and why is it hard to maintain over time?
Least privilege means granting an identity only the specific permissions it needs to do its job, nothing broader "to be safe" or "to save time." It's hard to maintain because permissions tend to accumulate, someone gets a broad role to unblock a one-time task and it's never revoked, or a service starts with wildcard permissions during initial development and nobody narrows them before shipping. Maintaining least privilege requires ongoing review (access audits, unused-permission detection), not just a careful initial setup, because the natural drift over time is always toward more access, not less.
What is the difference between a role and a policy in most cloud IAM systems?
A policy is a document that defines a set of permissions, which actions are allowed or denied on which resources, sometimes under which conditions. A role is an identity that policies get attached to, and which something (a user, or more commonly a workload like a compute instance or function) can assume to gain those permissions temporarily. The distinction matters operationally: policies are the reusable permission logic, while roles are how that logic gets bound to something that actually makes requests, separating "what is allowed" from "who currently has it."
OAuth 2.0 vs OpenID Connect
OAuth 2.0 handles authorization and OpenID Connect adds authentication on top. What each actually does, and why the distinction matters.