Identity and Access Management (IAM) Overview

IAM is a crucial component of our Cloud, ensuring secure and efficient resource management. Our IAM system uses Relationship-Based Access Control (ReBAC) for a flexible, modern approach to access management.

Key Concepts

Users

• Users have a unique email address and relate to one or more organizations.
• Users authenticate using a username and password. They can then manage resources across organizations and projects.
• You can invite users to an organization. If they do not yet have an account, an invitation email prompts them to sign up.

Teams

Teams are organization-scoped groups of users that manage access to projects and resources.

Service Accounts

Service Accounts are organization-scoped machine identities that authenticate applications and services.

Organizations, Projects & Resources

Our cloud environment uses a three-tiered hierarchical model:

1. Organizations: Top-level container for memberships and projects, as well as configuration options
2. Projects: Sub-containers within an organization to organize resources
3. Resources: Operational elements (VMs, networks, storage, etc.)

Permissions

• Fine-grained permissions based on relationships between entities:
  • User-to-Organization: Defines what a user can do within an organization
  • User-to-Project: Specifies a user's access rights for a particular project
  • Organization-to-Project: Determines how organization-level permissions affect project access
• Permissions are contextual and customizable based on specific roles or needs
• This relational approach allows for more nuanced and flexible access control compared to traditional role-based systems
• Users can have different privilege levels across organizations and projects

For detailed information on IAM, including features and advanced configurations, see our IAM product page.