Cloud IAM Architecture
Designing IAM Role Models, Permission Structures, and Identity Governance for Cloud and Hybrid Environments
Identity is the control plane for cloud environments, and IAM is where most cloud security programs are weakest. Permissions accumulate as teams add access for new projects but never remove it. Service accounts are over-permissioned because least-privilege is hard to determine without understanding application dependencies. Shared credentials persist because no one owns the migration to individual identities. Trust relationships between accounts are created ad hoc for integration needs and never reviewed.
This engagement designs a comprehensive IAM architecture: role model defining who gets what access and why, permission structure implementing least privilege at scale, service identity governance for non-human identities, privileged access management approach for break-glass and administrative access, and access governance processes for ongoing compliance. The architecture covers AWS, Azure, and GCP cloud IAM plus hybrid identity integration with Entra ID, Okta, Ping, and Active Directory.
The output is an implementation-ready IAM architecture — not a maturity assessment or policy document. It includes role definitions, permission boundary specifications, service account standards, and governance workflows that your team can implement directly.
Who This Is For
Ideal clients for this engagement.
The Problem
What this engagement addresses.
Permission Accumulation
Users and roles accumulate permissions over time as access is granted for new projects and responsibilities but never revoked. After a year, most identities have far more permissions than their current role requires — but no one knows which permissions are still needed.
Over-Permissioned Service Accounts
Service accounts and automation identities are granted broad permissions because determining least-privilege for non-human identities requires understanding application behavior. Admin-level service accounts become the norm because they 'just work.'
Shared Credentials and Service Keys
Long-lived API keys and shared credentials embedded in applications, scripts, and configurations. Rotation is manual and infrequent. Key compromise provides persistent, unmonitored access that is difficult to detect.
Ad Hoc Trust Relationships
Cross-account and cross-cloud trust relationships created for specific integration needs and never reviewed. Each trust relationship is a potential lateral movement path that expands the blast radius of any single account compromise.
Hybrid Identity Complexity
Federation between enterprise identity providers and cloud IAM creates complexity: attribute mapping, group synchronization, conditional access policies, and session management across multiple trust boundaries.
Deliverables
What you receive.
IAM Architecture Document
Comprehensive IAM architecture covering role model, permission structure, service identity governance, PAM approach, and access governance. Includes design decisions, rationale, and implementation specifications for each cloud provider in scope.
Role Model & Permission Structure
Defined roles with associated permissions, permission boundaries, and assignment criteria. Covers human identities (user roles), service identities (application roles), and administrative identities (privileged roles). Implements least-privilege through role hierarchy and permission boundaries.
Service Identity Governance Framework
Standards for service account creation, permission assignment, credential management (rotation, vaulting, workload identity), ownership assignment, and periodic review. Addresses the non-human identity lifecycle end-to-end.
Hybrid Identity Architecture
Federation design between enterprise IdP and cloud providers: attribute mapping, group synchronization, conditional access policies, session management, and break-glass procedures. Covers the selected identity providers and cloud platforms.
Methodology
How the engagement works.
Discovery & Current State Assessment
Weeks 1 – 2
- IAM inventory: users, roles, service accounts, policies, trust relationships
- Permission analysis: actual usage versus granted permissions
- Identity provider configuration and federation review
- Stakeholder interviews: identity team, security, cloud engineering, and application teams
Architecture Design
Weeks 3 – 6
- Role model design with permission structure
- Service identity governance framework development
- PAM approach design for administrative and break-glass access
- Hybrid identity architecture (federation, conditional access, session management)
- Access governance workflow design (access request, periodic review, certification)
Review & Delivery
Weeks 6 – 8
- Architecture review with identity, security, and cloud engineering stakeholders
- Migration approach for transitioning from current to target state
- Architecture document delivery
- Implementation guidance and knowledge transfer
Engagement Tiers
Scoped to your architecture.
Focused
Single cloud provider, up to 10 accounts. Human identity role model and basic service account governance. Single identity provider federation.
- Human identity role model and permission structure
- Service account inventory and governance standards
- Single IdP federation design
- IAM architecture document
- Migration approach
Standard
Up to 2 cloud providers, 15 accounts. Full role model (human + service + administrative), PAM design, and hybrid identity architecture. Up to 2 identity providers.
- Everything in Focused
- Multi-cloud IAM architecture
- Service identity governance framework
- PAM approach design
- Hybrid identity architecture (2 IdPs)
- Access governance workflows
Complex
Multi-cloud (2+ providers), 15+ accounts, complex hybrid identity with 3+ identity providers, and advanced requirements (B2B federation, workload identity, cross-cloud trust).
- Everything in Standard
- Complex hybrid identity (3+ IdPs)
- Workload identity design (SPIFFE/SPIRE or cloud-native)
- Cross-cloud trust architecture
- B2B federation design
- Advanced access governance with automation specifications
Prerequisites
- Cloud IAM configuration access (read-only) for current state analysis
- Identity provider documentation and configuration access
- Organizational structure and role definitions for role model design
- Compliance requirements for access governance (periodic reviews, segregation of duties)
- Application inventory for service identity governance scope
Frequently Asked Questions
Common questions.
Can you clean up our existing IAM permissions or does this only produce a design?
This engagement produces the architecture and design. Actual permission changes — role migrations, permission tightening, service account remediation — are implementation work best handled through the Cloud Security Remediation engagement, using the IAM architecture as the target state. This separation ensures the architecture is right before making changes that could impact production.
How do you determine least-privilege for service accounts when documentation is limited?
We use a combination of approaches: cloud provider access analyzer tools (IAM Access Analyzer, Azure AD access reviews, GCP Policy Analyzer) to identify actually used versus granted permissions, CloudTrail/Activity Log analysis for service account activity patterns, and application team interviews for intended functionality. The service identity governance framework also establishes a process for ongoing least-privilege refinement.
Does this cover non-cloud identity (Active Directory, Okta, Entra ID)?
Yes, to the extent that enterprise identity integrates with cloud IAM. The hybrid identity architecture covers federation between your enterprise IdP (Entra ID, Okta, Ping, Active Directory) and cloud provider IAM. On-premises-only identity architecture (AD domain design, OU structure) is not in scope — this engagement focuses on cloud IAM and the hybrid identity boundary.
Related Offerings
Often paired with this engagement.
Cloud Security Posture Assessment
Identifies IAM-specific findings that may require architectural redesign rather than tactical remediation.
Zero Trust Architecture Design
Identity is the foundation of Zero Trust. IAM architecture provides the identity control plane that Zero Trust policies depend on.
Cloud Security Remediation
Implements IAM architecture changes — role migrations, permission tightening, and service account remediation — delivered as IaC.
Secure Cloud Landing Zone
The landing zone's Identity & Access pillar implements the IAM architecture at the organizational level for all accounts.
Ready to discuss this engagement?
30-minute discovery call. We will discuss your application architecture, your specific concerns, and whether this assessment is the right fit.