Lesson 3: Enterprise Identity (IAM Identity Center) & The Azure Multi-Cloud Counterpart

🧠 The Concept (Explain Like I'm 5)

In a company with 1,000 employees and 200 AWS accounts: * The Nightmare (Local IAM Users): You create a separate IAM user for Alice in all 200 accounts (200 passwords, 200 MFA keys). When Alice leaves the company, someone forgets to delete her in Account #142, and an attacker uses it to breach your company. * The Enterprise Standard (SSO / Identity Center): Alice logs in once using Google Workspace, Okta, or Microsoft Entra ID. She sees a single dashboard with buttons for "Dev Account", "Staging Account", and "Production Account". When she leaves the company, HR disables her single corporate email, and she instantly loses access to all 200 accounts.

---

🏢 The Enterprise Context

• Permission Sets: In AWS IAM Identity Center, you never attach IAM policies directly to users. You define reusable Permission Sets (e.g. AdministratorAccess, BillingReadOnly, PlatformEngineerPowerUser) and assign them to corporate Active Directory groups.
• Multi-Cloud Parity (AWS vs Azure): As an Enterprise Platform Architect, you must speak both cloud dialects fluently. Enterprise governance maps directly between AWS and Microsoft Azure.

---

🗺️ Visual Architecture: Multi-Cloud Governance Mapping (AWS vs. Azure)

flowchart TD
    subgraph AWSModel ["AWS Multi-Account Model"]
        direction TB
        AWS_Root["AWS Organizations (Root)"]
        AWS_OU["Organizational Unit (OU)"]
        AWS_Account["AWS Member Account (Billing Boundary)"]
        AWS_SCP["Service Control Policy (SCP)"]
        AWS_SSO["IAM Identity Center (SSO)"]
        AWS_PermSet["Permission Sets"]

        AWS_Root --> AWS_OU --> AWS_Account
        AWS_SCP -.->|Guardrail over| AWS_OU
        AWS_SSO --> AWS_PermSet --> AWS_Account
    end

    subgraph AzureModel ["Azure Enterprise Model"]
        direction TB
        Az_Root["Root Management Group"]
        Az_MG["Management Group (Hierarchy)"]
        Az_Sub["Azure Subscription (Billing Boundary)"]
        Az_Policy["Azure Policy (Initiatives / Deny)"]
        Az_Entra["Microsoft Entra ID (Azure AD)"]
        Az_RBAC["Role-Based Access Control (RBAC)"]

        Az_Root --> Az_MG --> Az_Sub
        Az_Policy -.->|Guardrail over| Az_MG
        Az_Entra --> Az_RBAC --> Az_Sub
    end

    AWS_Root <==>|1:1 Equivalent| Az_Root
    AWS_OU <==>|1:1 Equivalent| Az_MG
    AWS_Account <==>|1:1 Equivalent| Az_Sub
    AWS_SCP <==>|1:1 Equivalent| Az_Policy
    AWS_SSO <==>|1:1 Equivalent| Az_Entra

---

📋 Comprehensive Enterprise Equivalence Matrix

Architecture Dimension	Amazon Web Services (AWS)	Microsoft Azure
Organizational Root	AWS Organizations Root	Root Management Group
Hierarchical Grouping	Organizational Units (OUs)	Management Groups
Billing & Isolation Boundary	Member AWS Account	Azure Subscription
Coarse Guardrails	Service Control Policies (SCPs)	Azure Policy (deny effects)
Identity Provider	IAM Identity Center (AWS SSO)	Microsoft Entra ID (formerly Azure AD)
Reusable Permissions	Permission Sets	Custom Role Definitions (RBAC)
Resource Grouping	Tags / Resource Groups	Resource Groups (Mandatory in Azure)
Central Transit Hub	AWS Transit Gateway (TGW)	Azure Virtual WAN (vWAN) / Virtual Network Gateway

---

💻 Production Code: AWS IAM Identity Center & Permission Sets via Terraform

# 1. Look up existing AWS IAM Identity Center instance
data "aws_ssoadmin_instances" "main" {}

# 2. Define reusable "Senior Platform Engineer" Permission Set
resource "aws_ssoadmin_permission_set" "platform_engineer" {
  name             = "PlatformEngineerPowerUser"
  description      = "Power user access to compute, networking, and storage; no billing"
  instance_arn     = tolist(data.aws_ssoadmin_instances.main.arns)[0]
  session_duration = "PT8H" # 8-hour maximum session duration
}

# 3. Attach AWS Managed PowerUserAccess policy to the Permission Set
resource "aws_ssoadmin_managed_policy_attachment" "power_user" {
  instance_arn       = tolist(data.aws_ssoadmin_instances.main.arns)[0]
  managed_policy_arn = "arn:aws:iam::aws:policy/PowerUserAccess"
  permission_set_arn = aws_ssoadmin_permission_set.platform_engineer.arn
}

# 4. Bind Permission Set to Active Directory group across Production Accounts
resource "aws_ssoadmin_account_assignment" "platform_team_prod" {
  instance_arn       = tolist(data.aws_ssoadmin_instances.main.arns)[0]
  permission_set_arn = aws_ssoadmin_permission_set.platform_engineer.arn

  principal_id   = "group-id-okta-active-directory-xyz" # Group from Okta/Entra
  principal_type = "GROUP"

  target_id   = "123456789012" # Production Member Account ID
  target_type = "AWS_ACCOUNT"
}

---

🛡️ Azure Policy Equivalent to an AWS SCP

Just like an AWS SCP denies unapproved regions, an Azure Policy can enforce location restrictions across an entire Management Group:

{
  "properties": {
    "displayName": "Allowed locations for all resources",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "description": "This policy enables you to restrict the locations your organization can specify when deploying resources.",
    "parameters": {
      "listOfAllowedLocations": {
        "type": "Array",
        "metadata": {
          "description": "The list of approved Azure regions"
        },
        "defaultValue": ["eastus", "eastus2", "centralus"]
      }
    },
    "policyRule": {
      "if": {
        "not": {
          "field": "location",
          "in": "[parameters('listOfAllowedLocations')]"
        }
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}