Download Publication

This localized version of this publication was produced from the original source material through the efforts of chapters and volunteers but the translated content falls outside of the CSA Research Lifecycle. For any questions and feedback, contact research@cloudsecurityalliance.org.

The purpose of this document is to provide an understanding of the challenges and considerations involved in managing Identity and Access Management (IAM) in the cloud, as well as the importance of IAM to an organization's overall security strategy.

Traditionally, IAM was intended as a general purpose mechanism to restrict and control access to enterprise resources by granting permissions to users or groups or users. The goal was entitlement, not so much control, and access was based entirely on assertions of username and password, coupled with group membership or permissions directly assigned at the resource. This model later evolved to centralize IAM, and access decisions were concentrated centrally at an authority such as a service, server, or Identity infrastructure. The threat landscape has materially changed over the years, and today, IAM is a core component of any digital access model. It evolves to employ ever-increasing visibility, granularity, and control as the nature of users, resources, and systems change.