Permissions, roles, and groups
Beyond establishing how identities are created and authenticated in a cloud environment, identities require some level of permissions to access resources within those cloud environments. In some cases, there may be a default level of access granted based on the type of account created (such as a default administrative user) or the assignment of users to a particular group that has been assigned an access policy (see Figure 3.8 for an example of policies in AWS):
Figure 3.8 – List of available AWS managed policies
For some cloud components and services, the concept of inheritance also exists, as well as the ability to manage permissions through RBAC and ABAC. Administrators may manage users and their permissions within a portal user interface (UI); however, they may also do this through the CLI, application programming interface (APIs), the use of cloud provider SDKs, or through integrated user life-cycle and management...
