Security & IAM
Study Guide

Authentication: prove identity (login, MFA, mTLS cert). Authorization: decide allowed actions for that identity (RBAC, ABAC, policies). Mixing them up is a common interview mistake.

OAuth2: delegated authorization framework (access tokens for APIs). OIDC: identity layer on OAuth2 - ID tokens (JWT) assert who the user is. "Login with Google" is typically OIDC; calling APIs with scopes is OAuth2.

RBAC: roles bind permissions to job functions (simple, auditable). ABAC: policies on attributes (department, resource tags, time) - flexible, harder to reason. Kubernetes RBAC is classic RBAC; AWS IAM conditions lean ABAC-ish.

SSO: one IdP login for many apps. SAML common in enterprises; OIDC modern for cloud-native. Central offboarding, MFA enforcement, audit trails - reduces scattered local passwords.

A privileged service (deputy) can be tricked into acting on attacker's behalf if resource policies/trust boundaries are wrong. Mitigate with source ARN/account conditions, scoped session policies, and avoiding overly broad sts:AssumeRole trusts.

Grant only the minimum permissions required for a task, for the minimum time. Applies to humans, CI roles, and runtime service accounts. Review periodically as systems evolve.

SCPs are organization guardrails - they limit maximum permissions; they do not grant rights by themselves. IAM policies grant/deny within the SCP boundary. Even root in a member account cannot exceed SCPs.

Highly audited, MFA-protected role for catastrophic lockouts - rarely used, session recorded, alerts to security. Avoid daily use; pair with regular access reviews.

Different principals for deploy vs production data access; approvals for production changes; CI cannot read prod secrets for dev jobs. Prevents single compromised token from owning everything.

IAM Access Analyzer, CloudTrail for API calls, periodic access reviews, Service Control Policies inventory, Permission Boundaries for high-risk roles, automated reports on unused permissions, central logging to immutable store.

Secret managers (Vault, AWS Secrets Manager, GCP Secret Manager), Kubernetes Secrets (encrypted at rest + RBAC), CI secret stores, or short-lived tokens from IdP. Never commit; rotate on leak.

Never trust the network; verify identity and device for every access decision with least privilege - "verify explicitly."

Mutual TLS: both client and server present certificates - strong service identity beyond bearer tokens on a flat network. Common in service meshes; reduces lateral movement if a pod is compromised.

Duplicate secrets across repos, k8s namespaces, and teams - rotation nightmare. Centralize in vault with dynamic secrets, standardize injection patterns, automate rotation, delete unused credentials.

Static keys on runners are long-lived and leak-prone. OIDC federation (GitHub Actions to AWS/GCP) exchanges short-lived tokens - no stored cloud keys. Prefer OIDC for greenfield pipelines.

Non-root user, drop capabilities, read-only root FS, no privilege escalation, seccomp profiles - reduce container breakout impact. Align with CIS benchmarks and PSP successors (PSA labels).

Role/ClusterRole: sets of verbs on resources. RoleBinding/ClusterRoleBinding: attach roles to users, groups, or ServiceAccounts. Prefer namespace Roles over ClusterRole where possible.

Webhook or built-in controllers that mutate/validate requests before persistence - OPA/Gatekeeper, Kyverno, image signature verification. Enforce labels, block latest tags, require resources limits.

Default tokens mounted into pods may be over-permissive if RBAC broad. Prefer bound tokens, short TTL, minimal ClusterRoleBindings, and disable auto-mount when unused.

Isolate node (cordon/drain), snapshot for forensics, revoke credentials that node could reach, rotate secrets, patch CVE, review seccomp/AppArmor profiles, incident ticket with timeline, postmortem on blast radius.

SAST: static code analysis (early, false positives). DAST: attack running app from outside. SCA: known vulnerable libraries (SBOM). Run multiple layers in CI.

Software Bill of Materials - inventory of components and versions. Enables rapid CVE response (Log4j-style). Formats: SPDX, CycloneDX. Generate in CI, store with artifacts.

Cryptographic signature (cosign/sigstore) proves image provenance and integrity. Admission controller verifies signature before deploy - prevents running tampered images from a compromised registry.

Web Application Firewall filters HTTP threats (SQLi, XSS patterns). Not a substitute for secure code, authz checks, or patching. Tune rules to avoid blocking legitimate traffic.

Shift-left: tests and reviews earlier in dev (lint, unit security tests, threat modeling). Shift-right: production detection (SIEM, runtime alerts, canaries). Balance: prevent regressions early, detect novel attacks in prod.

Hardening checklists - disable public S3, enable audit logs, restrict API server access. Automate checks (kube-bench, Prowler, ScoutSuite). Evidence for SOC2/ISO audits.

Attackers who gain admin cannot delete evidence if logs stream to WORM storage or separate account with append-only policy. Required for forensics and compliance.

Labels (public, internal, PII, PCI) drive who can access, encryption requirements, and logging redaction. IAM policies and resource tags should align with classification.

Strong namespace isolation, NetworkPolicies, separate ServiceAccounts per tenant where needed, encrypt secrets per tenant, avoid shared cluster-admin, consider hard multi-tenant vs cell-based architectures for largest customers.

Revoke/rotate leaked creds immediately, scope what APIs were callable, check CloudTrail/git logs for misuse, notify stakeholders, temporary blocks if needed, post-incident full rotation and root-cause (committed key, overly broad token).