IAM service overview
Overview
IAM (Identity and Access Management) is an infrastructure that provides two main functions: identifying and authenticating a user or service account, and authorizing access to a resource. An identity can be a physical person (user account) or a machine (service account).
Customers have a dedicated IAM infrastructure that ensures complete isolation of resources.
How it works
The IAM system manages the identity of users and service accounts according to the following aspects:
- identifying a user or a service account;
- robustness criteria for passwords (length, composition);
- two-factor authentication for physical persons;
- locking of the user account after three failed authentication attempts.
An IAM system is made up of two functions: authN and authZ.
The authN authentication strategy establishes the rules for verifying the identity of a user or service account requesting access.
The authZ access management mechanism controls the authorizations of users and service accounts. This component, which is independent of identity management, is designed to handle high request volumes.
Permission models
The IAM permission system makes it possible to implement different models for managing rights:
- RBAC (Role-Based Access Control): assigns one or more roles to each user or service account. Each role contains a set of permissions. Assigning a role grants all the permissions it contains.
- ACL (Access Control List): defines a single right of a user over a specific resource (such as a URL or a file). This is the most granular permission level.
Between these two models, you can assign a permission described in a role to a user. That user will then be able to perform the action on all the resources covered by that permission.
Three permission assignment methods are available:
- assigning a role to a user or service account;
- assigning a permission to a user or service account;
- assigning a specific right to a user for a specific resource (ACL).