Why architecture matters here
IAM architecture matters because access decisions happen on every request. A slow policy engine adds latency to every call; a permissive one is a breach waiting; a rigid one blocks legitimate work. Getting IAM right is the security-productivity balance.
Cost is modest. IdP + policy tooling; enforcement is often integrated. But engineer time is the real cost, both for building and operating.
Reliability of the IAM layer is critical. When the IdP is down, no one gets in. HA + graceful degradation matter.
The architecture: every layer explained
Walk the diagram top to bottom.
User / Workload. Anything requesting access. Human user or service account.
IdP. Identity provider — Okta, Azure AD, IAM Identity Center, Google IAM. Authenticates and issues tokens.
Token. JWT for API access, short-lived certs for mTLS, session cookies for browsers.
Policy Engine. OPA (Open Policy Agent), Cedar (AWS), or cloud-native policy engines. Evaluates policy rules.
RBAC / ABAC hybrid. Roles simplify management; attributes give fine-grained control. Modern systems combine both.
Enforcement. Where decisions are made — API gateway, service mesh sidecar, application code.
Audit. Every access decision logged. Detection + forensics + compliance.
Break-glass. Emergency access path — separate, heavily audited, rare use.
Access Reviews. Quarterly review of who has what. Revoke stale.
Just-in-Time. Elevate privileges temporarily; auto-expire. Reduce standing access surface.
End-to-end access flow
Trace a request. Engineer logs in via SSO to IdP. MFA + device posture check. IdP issues JWT with roles + attributes.
Engineer opens dashboard. Browser sends JWT to API gateway. Gateway calls policy engine: "user with role X, attribute env=prod, wants to POST /deploy on service Y."
Policy engine consults rules: deploy requires role deployer + env matches user's assigned env. Match; approve.
Enforcement allows. Audit log records: user, action, decision, timestamp.
Later, engineer needs to access sensitive data. Not in standing roles. Requests JIT elevation: "read prod-db, 30 min, reason X." Approval workflow: manager approves. Temp role granted for 30 min; auto-revokes.
Access review: quarterly. Manager reviews team's roles. 2 team members left; roles auto-flagged; revoked.
Break-glass: prod-critical incident 3AM. On-call engineer uses break-glass; heavily audited; manager notified; used for 20 min then revoked. Post-incident review confirms need.