Cloud identity is the control plane for everything else. If an attacker can change permissions, they can often reach the data without exploiting a single application bug.
Principals and policies
- Principal: who is asking (user, role, service, federated identity).
- Action: what they want to do.
- Resource: what they want to do it to.
- Condition: when it is allowed.
- Effect: allow or deny.
A policy statement combines these. Read all five parts before approving.
Roles over long-lived keys
A role is an identity that can be assumed temporarily. Short-lived credentials reduce the value of a leak. Long-lived access keys are still common; rotate them, scope them and avoid them where federation is possible.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.