Balance least privilege & agile development
summary
Merck automates account provisioning with DynamoDB streams, Lambda, CloudFormation stack sets and CI/CD to cut setup from weeks to about an hour and runs serverless auto-remediation via EventBridge, SNS/SQS and Step Functions; IAM Identity Center and Access Analyzer enforce least privilege. Fidelity runs a custom REST API for IAM with 2 million deployments and ~3,000 create/destroy ops per day, hit ~200,000 roles across 1,400 accounts, and moves to an IAM taxonomy + CloudTrail Lake approach to narrow permission boundaries and validate changes.
AI-written summary · about
chapters (9)
- 0:00Introduction and context
- 5:01Access models and AWS journey
- 8:35Foundational cloud security
- 13:06Merck's cloud transformation
- 19:08Security control implementation
- 25:44Compliance and remediation
- 34:08Fidelity's IAM strategy
- 40:48Taxonomy-based IAM scaling
- 49:04Conclusion and takeaways
related talks
49mapproach for secure and resilient applications
44mAchieve your identity, security, and compliance goals on
32mWhizBangLambdaFix: where AWS Misconfigurations...
01h 03mContinuous Security in the Cloud
26mCase Study of Success
49mPublic cloud in regulated industry, not just swipe of a cred
50mAutomated Serverless Security Testing: Delivering secure apps continuously
49mCloud operations: A catalyst for innovation