Role-Based Access Control: Flexible Trust with Maestro

Self-service is one of the five keystones for any effective cloud service. This applies not only to the provisioning of services to customers but also to the way the customers organize their internal workflows.

An enterprise that does not allow self-service in Cloud for its employees would definitely lose a big part of Cloud benefits, as the operational part will be complicated, slow, and not reactive enough to face the enterprise needs or arising threats properly.

However, the question is – when enabling self-service, how to make sure that things don’t go out of control, especially for large teams and infrastructures?

Standard Role-Based Access Control (RBAC)

Typically, cloud providers allow their customers to set up role-based access to infrastructure management. In this approach, possible operations are combined into roles, typically by purpose.

The users, in their turn, are combined into user groups, according to the tasks they perform and the access level they need to have.

The roles are assigned to user groups, thus specifying which actions should be available to the users belonging to the specific group.

Is it enough?

The mentioned approach is an industry-standard, but despite its apparent simplicity, there is a number of drawbacks, which include manual management and the need for regular maintenance.

To update the role-based access, the operator needs to reach the respective settings and introduce changes to specific groups or roles. Updating the permissions for a specific person also requires these manual adjustments, the introduction of the new roles, etc.

Thus, the approach may lack flexibility, which results into situations when much extra effort should be paid to customizations, workarounds created, or specific tasks have to be re-delegated to other responsible users – just due to lack of permissions or insufficient processes.  What is worse, the situations can take place when the users belonging to specific groups have more permissions than they actually need – just in case, or due to the updates that were needed to meet the needs of only specific members of the group.

How does Maestro enable access flexibility?

In Maestro, the role-based access model is balanced by the approvals mechanism that initially allows to prompt management for new resources creation once a specified monthly expenses limit is reached.

However, to make the access management flexible, this was not enough.

Recently, we started the process of allowing quick on-the-go changes to a specific person’s permissions set, based on an ad hoc request.

The approach is simple: once a user tries to perform an action via Maestro, that is not available for them, the application suggests requesting the respective permission from a tenant manager. The request goes to the manager’s email and can be either approved or denied within minutes after being submitted.

As soon as the manager clicks Approve, the requestor’s permissions set is updated with the new allowed operation – which is granted exclusively for this requestor, as the change does not affect the other members of the user groups they belong to.

 

This feature improves the standard role-based approach by adding one-click flexibility to it. Thus, the initial minimum necessary access provided for a group becomes a basic starting point for personalized settings. Each person gets a refined permission set that meets their exact tasks and goals within the tenant.

Currently, we only started working on access flexibility by demand. We have a whole set of ideas for the subject – so keep track of the updates!