Cloud IAM for people and workloads
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
design least-privilege cloud IAM.
Planned topics
- People get roles through the IdP, with just-in-time elevation for admin tasks; no shared accounts.
- Workloads get identities (roles) with short-lived credentials from the platform; avoid long-lived access keys.
- Write policies with least privilege and review them regularly.
- Separate duties: those who deploy to prod differ from those who approve.
- Break-glass accounts: few, protected, alerting on use.
Draft outline details
Demonstration
a policy sketch for the order service: read the orders queue, write to one bucket path, nothing else.
Check your understanding
What replaces long-lived access keys for workloads?
Show answer
Platform-issued roles with short-lived credentials.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.