Skip to content

Identity and IAM¶

Authentication ("who are you?"), authorization ("what can you do?"), federation, roles vs policies, RBAC vs ABAC, SSO. Every cloud cert tests this; almost every breach starts here.

flowchart LR
  REQ[Request:<br/>credentials + action + resource] --> N{Authenticate}
  N -- valid --> ID[Verified identity:<br/>user / role / service account]
  N -- invalid --> X1[401]
  ID --> Z{Authorize<br/>policy lookup}
  Z -- allow --> OK[Execute]
  Z -- deny --> X2[403]
  IDP[External IdP:<br/>Okta, Azure AD, Google] -. SAML / OIDC / SCIM .-> N

Learn¶

IAM explained - authentication vs authorization, roles vs policies, federation, RBAC vs ABAC

Compare¶

Identity and IAM services - AWS IAM vs Azure Entra ID vs Google Cloud IAM
Security tools - secrets, threat detection, WAF

Reference¶

Architecture pattern: Zero Trust - identity-centric security
Compliance: SOC 2 - access controls and identity audit
Compliance: HIPAA - access management requirements

Build¶

Implement zero trust - identity-aware proxy, MFA, least privilege

Certify¶

IAM appears on most cloud certs. Where it's most heavily tested:

Foundational - AWS Cloud Practitioner - Azure AZ-900 - Microsoft Security Fundamentals (SC-900)

Associate - AWS Solutions Architect Associate (SAA-C03) - AWS Developer Associate (DVA-C02) - Azure Administrator (AZ-104) - GCP Cloud Engineer - HashiCorp Vault Associate - secrets and identity-based access - HashiCorp Boundary Associate - identity-aware access broker

Specialty / Expert - AWS Security Specialty (SCS-C02) - Azure Security Engineer (AZ-500) - GCP Cloud Security Engineer - Microsoft Security Operations Analyst (SC-200)

Vendor-neutral capstones - CISSP - identity and access management is one of 8 domains - CCSP - CCSK v5

Roadmap¶

The career-track view lives in Security Engineer roadmap.