DevSecOps Practice Hub

Identity & Access Management

Design least-privilege access for humans and workloads with short-lived, auditable credentials.

AdvancedIAMIdentityCloudGovernance

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Plan Threat modeling, requirements and security design decisions.
  • Deploy Policy enforcement, admission control and infrastructure security.
  • Operate Runtime security, secrets rotation and configuration reconciliation.

Overview

IAM covers who can do what, for how long, and how it is proven. Workload identity via OIDC federation removes most stored credentials from pipelines and clusters.

Why it matters

Excess standing privilege turns a small compromise into a large one.

How it works

  1. 01Human access is federated through an identity provider with MFA.
  2. 02Workloads use OIDC federation to assume scoped roles.
  3. 03Permissions are reviewed against actual usage data.

Common tools

HashiCorp VaultKeycloakAWS IAMOpen Policy AgentAWSAzureKubernetesVault

Implementation examples

jsonOIDC trust policy for CI
{  "Effect": "Allow",  "Principal": { "Federated": "arn:aws:iam::111122223333:oidc-provider/token.actions.githubusercontent.com" },  "Action": "sts:AssumeRoleWithWebIdentity",  "Condition": {    "StringEquals": {      "token.actions.githubusercontent.com:sub": "repo:acme/app:ref:refs/heads/main"    }  }}
The subject condition must pin repository and ref; a wildcard would let any repository assume the role.

Best practices

  • Federate instead of storing keys.
  • Review permissions against usage.
  • Require MFA for all human access.

Common mistakes

  • Wildcard trust conditions in OIDC role policies.