IAM and roles
Manage product users, groups, roles, and Cedar policies — authenticate with local or SSO sessions; authorize every API with default-deny. Fabric mgmt tokens never become Cloud sessions.
Cloud /iam — Users, Groups, Roles, Policies, Sessions. Access keys are hashed at rest (secret shown once). LAN membership is not authorization.
Trust layers
Product IAM ≠ fabric ≠ kube RBAC
Buyers see a real IAM surface — users, roles, and Cedar — not “trust the network.” Same product identity for console humans and service callers.
Product IAM
Cloud users, groups, roles, Cedar policies, access keys, and HttpOnly sessions. This is the identity buyers and operators use.
Fabric mgmt / break-glass
Daemon and host ops tokens. They never become Cloud cookies or product sessions.
Kubernetes SA RBAC
Guest-cluster identities stay in-cluster. Product ARNs and Cedar sit above kube RBAC.
- 1
Sign in locally or via SSO
Local passwords are Argon2id with optional TOTP. SSO providers can be shared by Cloud and pack UIs (Argo CD, Grafana, …). Sessions are HttpOnly — not localStorage tokens.
- 2
Attach roles and Cedar policies
Roles bind named Cedar policies to users and groups. Missing policy or evaluator error denies — default deny, not LAN trust.
- 3
Authorize every API by ARN + action
Calls carry product principals. AuthZ uses aanjaleya:<service>:::<resource-type>:<id> minted via libraries only.
- 4
Service callers use access keys
CapA, Cloud controllers, and automation mint access keys — secret shown once, hashed at rest, rotatable. Fabric mgmt token stays out of this path.
Cedar default-deny
Every Cloud and product API authorizes with Cedar. Missing policy or evaluator error denies. Fabric mgmt / break-glass stays off the product session path — see also Managed Secrets & KMS for AMS-backed SSO client secrets.
// Evaluator error or missing policy → deny // LAN / Serf membership is not authorization permit ( principal == Aanjaleya::User::"ops@site", action == Aanjaleya::Action::"cloud:ListClusters", resource );
Product ARNs
Minted via libraries only — aanjaleya:<service>:::<resource-type>:<id>.
aanjaleya:iam:::user:ops@site aanjaleya:iam:::role:AdministratorAccess aanjaleya:iam:::policy:ReadOnlyAccess aanjaleya:cloud:::cluster:payments