Published lesson · 35 minutes

Protect identities and cloud access

Objective: Apply least privilege, multifactor authentication, secret handling and a shared-responsibility review to a small cloud application.

Start with the user need

Cloud security begins with identities: people and services receive permissions through accounts, roles or policies. Least privilege grants only the access needed for a defined task and reviews it as that task changes. Separate human access from application identity. Use multifactor authentication where supported, unique accounts, short-lived credentials where available, and a documented process for removing access when a role ends. A small team maintains the registration website and an automated deployment process.

Make the trade-offs clear

For a small learning exercise, keep names and records fictional. First state the user need, then select the simplest design that meets it. Compare the benefit with a limitation such as connectivity, service dependency, configuration effort or recurring cost.

Grant the minimum actions and resources needed, then test that legitimate work still succeeds.
Keep secrets in an approved secret store or protected environment configuration; rotate exposed credentials promptly.
Check both provider responsibilities and customer responsibilities for identity, network rules, application code and data.

A cloud design is a set of trade-offs rather than a promise. Record assumptions about expected users, sensitive information, connectivity and the people who will operate the service. Revisit those assumptions when the audience or risk changes.

Practice scenario: A small team maintains the registration website and an automated deployment process. Create a fictional access matrix for a learner, developer and deployment service. List what each needs to do and remove any permission that does not support that task.

Worked examples