IAM on Hybrid Cloud: Next Generation Security Model to Create an Interoperable Cloud [I]
summary
PADME proposes a concrete reference architecture: a common expression syntax plus composable policy bundles, distributed controllers and enforcers, and plugin adapters that map policies to devices. Policies include provable identity, time/location as first-class attributes to handle temporality and geo constraints, and rule precedence across an enforcement-surface onion. A working prototype exists as an Envoy authorization plugin that applies PADME policies to MySQL or HTTP endpoints; code is in a private GitHub with a demo planned.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:05Twin Problems: Heterogeneity & Temporality Configuring Access Policies is Hard
- 6:04Goals
- 7:46Approaching the Problem
- 11:44A Common Model & Common Syntax
- 15:08Policy Basics
- 20:08System Architecture
- 24:57Digression on RBAC
- 26:47Next Steps
related talks
36mDynamic and Context-Aware Security Policies for the Cloud Using...
22mThe Cloud Native Paradigm: 2019 and Beyond
48mBeyond Entitlements for the Cloud Native
40mSecurity Policy Management in the Hybrid Cloud
41mBuilding Modern Authorization: A Practical Guide To Centralized, Distributed, and...
31mAccess Policies for Hybrid Cloud Environments
40mHow to Operationalize Access Policies for Multiple Clouds
30mThe Next-Gen Elephant in the Room