Identity & Access (IAM)

In the cloud, Identity is the new perimeter. Firewalls are no longer enough. You must control exactly WHO (User) and WHAT (Service) can access your resources.

1. Principle of Least Privilege

Never give a developer "Owner" or "Admin" access to production. Give them only the permissions they need to do their job (e.g., "SQL Read Only"). This prevents accidental (or malicious) data deletion.

2. Managed Identities (Service Principals)

How does your App talk to your DB? Historically, we used passwords in config files. Today, we use Managed Identities. The Azure/AWS platform itself vouches for the app. No passwords, no rotation, 100% security.

4. Interview Mastery

Q: "What is Multi-Factor Authentication (MFA) fatigue and how do you combat it?"

Architect Answer: "MFA fatigue is when a hacker sends 100 push notifications to a user's phone until they accidentally click 'Approve.' We combat this with **Conditional Access Policies**. We only ask for MFA if the user is logging in from a new IP, a new country, or a non-compliant laptop. We also use 'Number Matching,' where the user must type a code shown on the screen into their MFA app, making accidental approval impossible."