Appearance
Identity, Access & Secrets
title: Identity, Access & Secrets description: Guidance on workforce identity, CI/workload IAM, application RBAC, and secret lifecycle for AWS.
Conceptual model for workforce identity, CI/workload IAM, application RBAC, and secret lifecycle in an AI-native enterprise stack on AWS.
Reference template — no production code.
Decision guide: Identity, access & secrets
Related: Data governance · AI guardrails · CI/CD topic · GOVERNANCE
Why this is separate from data governance
Data governance focuses on what data is (classification, lineage, retention). This topic focuses on who and what may act (humans, pipelines, services, end users) and how credentials are stored and rotated.
AI increases risk in all three planes: developers paste secrets into prompts, generated IaC grants "Action": "*", and auth code often ships without authorization tests.
Three access planes
| Plane | Question it answers | Primary AWS tools |
|---|---|---|
| Workforce | Which engineer can touch which account? | IAM Identity Center, permission sets, CloudTrail |
| Machine | Which pipeline/workload can deploy or read data? | OIDC, IAM roles, KMS, SCPs |
| Application | Which end user can perform which action? | Cognito, API Gateway authorizers, Verified Permissions |
Full option comparisons: Guide: Identity, access & secrets.
Secret lifecycle (reference model)
Secrets flow through detection, storage, consumption, and rotation — not a single tool.
| Layer | Reference in this repo |
|---|---|
| Detect in Git | Linters guide · SOP-005 |
| Policy (no paste to AI) | SOP-010 |
| Runtime storage | CI/CD topic · Developer workflow |
| Rotation & break-glass | Identity guide |
Permission matrix (summary)
Align IAM and RBAC with GOVERNANCE decision rights. Expand in your ADR.
| Role | Dev account | Staging | Prod data plane | Prod deploy |
|---|---|---|---|---|
| DEV | Read/write app | Read; deploy via CI | No direct access | No |
| ARCH | Read + design | Read | Read logs/specs | Consult T1 |
| SRE | Infra read/write | Deploy | Operate + incident | Accountable T1 |
| SEC | Security read | Scan configs | Audit read | Consult |
| PO | — | Staging validate | No | Informed |
| CI (build) | Build, test, scan | — | — | No |
| CI (deploy) | — | Deploy | Deploy via gate | T1 manual approval |
Application end-user roles (customer RBAC) are defined per product ADR — see guide checklist.
Integration with delivery phases
| Phase | Access focus |
|---|---|
| Plan | Classify whether feature needs new roles/secrets |
| Define | Threat model includes IAM blast radius; ADR documents RBAC |
| Build | Task roles in IaC; no secrets in repo |
| Verify | Secret scan gate; OPA on IAM policies; authz tests |
| Release | Deploy roles only in CD; KMS keys per env |
| Operate | Access Analyzer, GuardDuty, SM access anomalies |
| Learn | Postmortem: was excess permission a factor? |
Role-specific views: Security perspective · DevOps perspective · Developer perspective.
Quick links
| Need | Go to |
|---|---|
| Compare IdP / Cognito / custom RBAC | Guide § Application RBAC |
| CI OIDC vs static keys | Guide § CI/CD & runtime IAM |
| Secret rotation policy | Guide § Secret management lifecycle |
| Phase × role permissions | Guide § Permission matrix |
| Scanning only (not storage) | Linters & static analysis |