Identity and access
🎯You'll be able to
Give people and programs only the access they need, avoid long-lived keys, and let a pipeline reach the cloud without storing a password.
🏠The everyday picture
In an office, the cleaner's key opens the corridors, not the accounts safe. Visitors get a day pass that stops working at 6 pm, rather than a permanent key they might lose.
📘What it really is
-
Identity and Access Management (IAM) decides who (a person or a program) can do what, to which resource. AWS IAM, Google Cloud IAM and Azure role-based access control (RBAC) all work this way.
-
The account's root or owner can do everything. Protect it with multi-factor authentication (MFA), lock its credentials away, and don't use it for daily work.
-
People sign in through single sign-on (AWS IAM Identity Center, Google Workspace, Microsoft Entra ID) and get roles, with MFA.
-
Programs (servers, containers, pipelines) use roles that give short-lived credentials automatically, not long-lived access keys copied into files.
-
Least privilege: give only the actions and resources needed. An AWS policy that lets the RouteRani API read only its own secret:
json { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:ap-south-1:111122223333:secret:routerani/prod/db-*" }] }(111122223333is AWS's example account number.) Avoid"Action": "*"and"Resource": "*"except for deliberate admin roles. -
Pipelines without stored keys: GitHub Actions can prove who it is with a short-lived OIDC token. The cloud trusts tokens from your repository (and, ideally, only from the
mainbranch or a named environment) and gives the job a role for a few minutes. No access key is stored in GitHub (CD7 Lesson 4). -
Review and record: cloud audit logs (AWS CloudTrail, Google Cloud Audit Logs, Azure Activity Log) record who did what. Review unused permissions and remove them.
📝A worked example
Input: compare two ways for the RouteRani deploy job to reach AWS.
Expected output:
| Access key in a GitHub secret | OIDC role | |
|---|---|---|
| What's stored in GitHub | a key that works until someone deletes it | nothing secret, only the role's name |
| If it leaks | works from anywhere, for months | a token that expires within the hour, accepted only for your repository |
| Who can use it | any workflow that can read the secret | only jobs matching the trust conditions, such as main in the production environment |
| Rotation | manual | not needed |
🌍Where it's used
- Every regulated company must show least privilege and MFA in audits.
- Pipelines at most mature teams use OIDC roles instead of stored keys.
- Incident response: the first question after a leak is "what could that identity do?", which least privilege keeps small.
📝Case scenario
A developer at an edtech startup pushed a long-lived AWS access key to a public repository by mistake. Automated bots found it within minutes and started cryptocurrency-mining servers in several regions, running up a large bill overnight. The key belonged to an admin user with no restrictions. Afterwards they removed all long-lived keys, moved the pipeline to OIDC, and gave developers roles through single sign-on with MFA.
🖱️Try it
Write a least-privilege policy for a job that may only upload files to the routerani-reports bucket under the daily/ folder (action
s3:PutObject, resource arn:aws:s3:::routerani-reports/daily/*). Success: no * in the action, and the resource names one folder.
⚠️Common mistakes
- Daily work as root or owner. Sign: one stolen password controls everything. Fix: MFA on root, separate everyday roles.
- Long-lived keys in files or CI secrets. Sign: keys older than a year in use. Fix: roles and OIDC; delete old keys.
*permissions "to get it working". Sign: policies withAction: *. Fix: start narrow; add actions the audit log shows are needed.
🛠️For your project
Project 2's deploy job uses GitHub's production environment. In your capstone write-up, explain how it would reach a cloud with OIDC
instead of a stored key.
✅Quick check
Why prefer roles over access keys for programs?
Show the answer
Roles give short-lived credentials automatically, so there's no long-lived key to leak or rotate.
What does OIDC let a pipeline do?
Show the answer
Prove its identity with a short-lived token and get a cloud role without storing a secret.