Authorisation

Controlling Who Can Do What

In the world of cloud computing, authorisation plays a crucial role in maintaining the security and integrity of systems, applications, and data. While authentication answers the question, Who are you?, authorisation goes a step further and asks, What are you allowed to do?

Let’s consider a real-world scenario: Your company stores customer records in a cloud database. A customer support agent needs access to view customer profiles but should never be able to delete or modify them.

Through cloud authorisation, you can create a policy or assign a role that grants read-only access, ensuring data security, accountability, and compliance without slowing the agent down.

Authorisation in the Cloud

Authorisation in the cloud is the process of determining which resources an authenticated user, application, or system is permitted to access and what actions they can perform on those resources. This spans a wide range of operations, including but not limited to:

• Reading data from databases or storage buckets
• Modifying files, configurations, or records
• Deploying applications or services
• Managing infrastructure such as virtual machines, networks, or security groups
• Deleting resources or revoking other users’ access

Without authorisation, every authenticated user would have unrestricted access to everything. A scenario that would be both chaotic and dangerous.

Why Authorisation Matters

The cloud offers unparalleled flexibility and scalability, but without strict access controls, it can also open the door to significant risk. Data breaches, accidental deletions, compliance violations, and insider threats are all consequences of poorly managed access. Proper authorisation mechanisms ensure:

Least Privilege Access

Users only receive the permissions they need to do their jobs. Mo more, no less. This dramatically reduces the blast radius if an account is compromised.

Resource Protection

Sensitive data and critical services are only accessible to approved individuals or systems. This keeps proprietary information, customer data, and infrastructure configurations safe.

Regulatory Compliance

Many industries (healthcare, finance, government) are subject to strict regulations such as HIPAA, GDPR, SOC 2, and PCI-DSS, all of which require documented and enforceable access controls.

Auditability

Cloud platforms like AWS, keep detailed logs of who accessed what and when. Services such as AWS CloudTrail are critical for compliance reporting, forensic investigation, and troubleshooting.

Separation of Duties

Authorisation enables organisations to ensure that no single individual has unchecked control over critical processes. For example, the person who writes code should not be the same person who approves its deployment to production.

Common Cloud Authorisation Models

1. Role-Based Access Control (RBAC)

Users are assigned roles, and each role carries a predefined set of permissions. For example, a Developer role may allow code deployment, while an Admin role grants broader access to system settings and user management.

Best for: Organisations with clearly defined job functions and predictable access needs.

Example: In AWS, you might create an IAM role called S3ReadOnlyAccess and attach it to all data analysts in your team.

2. Attribute-Based Access Control (ABAC)

Permissions are granted based on attributes such as department, geographic location, project tag, security clearance, or even time of access. This model is more flexible and dynamic than RBAC.

Best for: Large, complex environments where access needs to adapt to changing contexts.

Example: A policy that allows access to a resource only if the user’s department tag matches the resource’s department tag and the request is made during business hours.

3. Policy-Based Access Control

Cloud-native services like AWS IAM allow the creation of fine-grained policies written in JSON or YAML that define access at the user, group, service, and resource level.

Best for: Granular, custom access control scenarios across cloud services.

Example: An AWS IAM policy that explicitly allows an EC2 instance to read from a specific S3 bucket but denies access to all other buckets.

4. Rule-Based Access Control

Access is determined by a set of predefined rules set by a system administrator. Unlike RBAC (which is based on roles), rule-based control applies universally regardless of who the user is.

Best for: Enforcing blanket security rules such as blocking access from certain IP ranges or outside business hours.

Best Practices for Authorisation in the Cloud

1. Apply the Principle of Least Privilege

Start with zero permissions and grant only what is necessary. Regularly prune unused permissions.

2. Use Roles and Policies Instead of Direct Permissions

Assigning permissions directly to individual users leads to sprawl and management headaches. Group-based and role-based approaches scale far more effectively.

3. Regularly Review and Audit Permissions

Access needs change as people switch teams, projects, or leave the organisation. Schedule periodic access reviews (at least quarterly).

4. Use Multi-Factor Authentication (MFA) Alongside Authorisation

MFA strengthens the authentication layer, ensuring that even if credentials are compromised, unauthorized access is far less likely.

5. Implement Deny-by-Default Policies

Unless explicitly permitted, access should be denied. This prevents accidental exposure of sensitive resources.

6. Tag and Organise Resources

Consistent resource tagging (by environment, project, team) makes it far easier to write and manage authorisation policies.

7. Automate Where Possible

Use Infrastructure as Code (IaC) tools like Terraform or AWS CloudFormation to define and version-control your access policies, reducing human error.

Putting It All Together With An Analogy

A High-Security Office Building

Authentication is like checking in at the front desk. You show your ID badge, and the security guard confirms who you are.

Authorisation, on the other hand, is what determines which doors your access card can open once you’re inside. Maybe you can get into the marketing department, but not the server room or the executive suite. Your level of access is based on your role, your clearance level, and your responsibilities.

Now imagine you’re a contractor brought in for a specific project. You’d get a temporary badge that only opens the doors relevant to your work and it expires when the project ends. That’s the principle of least privilege and time-bound access in action.

In the cloud, it works the same way: after verifying your identity (authentication), authorisation controls what you’re allowed to do and see based on policies, roles, or attributes.

🏗️ Let’s Build

Authorisation in Action

I know (and hope) you’re eager to get started, so in this practical, hands-on tutorial we’ll…

Create an IAM group and assign granular limited permissions.

This will demonstrate Authorisation

Prerequisites

1. Access Control
2. An AWS Administrative Account
3. Multisession Support Enabled

Identity-Based Access Control

Step 01: Sign in with your Administrative Account in order to grant permissions to your active Development IAM Account.

Step 02: Select ⁝⁝⁝ Security, Identity & Compliance on the left side of the drop down menu.

Step 03: Select IAM.

You should be redirected to the IAM Dashboard.

Step 04: On the left side of the screen under ▼ Access management

Select User groups

Step 05: User groups

Click Create group

Step 06: Create user group

User group name: Authorisation

Add users to the group — Optional: Add your CloudGlossary IAM User.

Attach permissions policies — Optional: AmazonEC2ReadOnlyAccess

Click Create user group

✅Green banner: Authorisation user group created.

Step 07: Add session and sign in with your IAM Account

Launch EC2 Instances

Step 08: Select ⁝⁝⁝ Compute on the left side of the drop down menu.

Step 09: Select EC2.

Step 10: Click Launch instance.

Step 11: Launch an instance

Name: Authorisation

▼ Application and OS Images (Amazon Machine Image)

Select Amazon Linux 2023 kernel 6.1 AMI (Free Tier eligible)

Get Ntombizakhona Mabaso’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

▼ Instance type

Select t3.micro (Free tier eligible).

▼ Key pair (login)

Key pair name — required: CloudGlossary

Click Launch instance.

❌ Red Banner: Instance launch failed

You failed to launch the instance because neither your user nor your group has the permissions to launch instances, only to view them.

Basically, you’re not authorised to launch EC2 instances.

🏁End of Building Tutorial 🏁

Clean Up Procedure

⚠️Terminate Resources⚠️

If you launched any instances or services, don’t get a Bill Shock by leaving unnecessary resources running.

1. Login with your Administrative Account, and Delete The Group.

⛔ End of Cleaning Up Protocol ⛔

                ┌──────────────────────────────┐
                │   Admin (Root / IAM Admin)   │
                │  (Full Permissions)          │
                └────────────┬─────────────────┘
                             │
                             │ Creates & Configures
                             ▼
                ┌──────────────────────────────┐
                │  IAM Group: "Authorisation"  │
                │  Policy: EC2 ReadOnly        │
                └────────────┬─────────────────┘
                             │
                             │ Assigns User
                             ▼
                ┌──────────────────────────────┐
                │     IAM User (Developer)     │
                │   Limited Permissions        │
                └────────────┬─────────────────┘
                             │
                             │ Attempts Action
                             ▼
                ┌──────────────────────────────┐
                │        Amazon EC2            │
                │  Launch Instance Attempt     │
                └────────────┬─────────────────┘
                             │
                             ▼
                    ❌ Access Denied
          (Not Authorised to Launch Instance)

Building Tutorial Overview

The tutorial demonstrates identity-based access control on AWS using two accounts in parallel sessions: an admin and a development IAM user.

The admin signs into IAM, creates a user group called “Authorisation”, adds the development user to it, and attaches the AmazonEC2ReadOnlyAccess managed policy.

The development user then switches sessions and attempts to launch an EC2 instance (Amazon Linux 2023, t3.micro).

The launch fails with a red banner, the expected and intentional outcome because the policy only grants read access, not the ability to create instances.

The failure is the proof of concept: authorisation is working exactly as intended.

Additional Resources

Access Control

Imagine a world where anyone, regardless of authority or qualifications, could do whatever they wanted.

Think about someone unqualified performing medical procedures on you or an unlicensed, inexperienced driver transporting your loved ones.

That kind of chaos is something I’d never want to face.

Authentication

Authentication is rooted in a straightforward principle: before you let someone in, make sure they are who they claim to be.

In a physical world, this might mean checking a driver’s license or a passport.

In the digital world, and especially in the cloud, authentication translates this concept into technical mechanisms that verify user identity across networks, devices, and applications.

What is IAM?

AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources.

With IAM, you can manage permissions that control which AWS resources users can access.

You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.

IAM provides the infrastructure necessary to control authentication and authorization for your AWS accounts.

Summary

Prerequisites

1. Access Control
2. Authentication

Theory

1. Introduction
2. Authorisation in the Cloud
3. Why Authorisation Matters
4. Common Cloud Authorisation Models
5. Best Practices
6. Putting It All Together With An Analogy: A High Security Office Building
7. Concluding Remarks: The Impact of Artificial Intelligence on Glossary Term

Cloud Glossary Terms Mentioned in this Article

1. Access Control
2. Attribute
3. Authentication
4. Automate
5. Buckets
6. Cloud Native
7. Data
8. Database
9. IP
10. Least Privilege
11. Logs
12. Multifactor Authentication
13. Networks
14. Scalability
15. Security
16. Security Groups
17. Storage
18. Tag
19. Virtual Machines

Alternatives to Reading

Listen on Spotify

Cloud Computing Simplified: A Cloud Glossary for Beginners

Episode Name: Authorisation

By: Ntombizakhona Mabaso

Concluding Remarks

Authorisation in the cloud is about control making sure the right people have the right access at the right time. Combined with strong authentication, it forms one of the foundational pillars of a secure cloud strategy.

As organisations continue to scale and migrate workloads to the cloud, understanding and implementing robust authorisation frameworks becomes more important than ever.

The Impact of AI on Authorisation

Artificial intelligence is beginning to reshape how authorisation is designed, managed, and enforced in cloud environments. Here are the key ways AI is influencing this space:

1. Intelligent Permission Recommendations

AI-powered tools can analyse usage patterns and recommend right-sized permissions. For example, AWS IAM Access Analyzer uses automated reasoning to identify overly permissive policies and suggest tighter alternatives, helping teams enforce least privilege without the guesswork.

2. Anomaly Detection and Adaptive Access

Machine learning models can establish baselines of normal user behaviour and flag deviations in real time. If a developer who typically accesses resources during business hours suddenly makes API calls in the AMs from an unfamiliar location, AI-driven systems can automatically trigger additional verification or temporarily restrict access.

3. Automated Policy Generation and Management

Rather than manually crafting JSON policies, AI tools can generate authorisation policies based on observed behaviour, job function descriptions, or natural language prompts. This lowers the barrier to entry for teams without deep security expertise.

4. Dynamic and Context-Aware Authorisation

AI enables a shift from static role assignments to dynamic, context-aware access decisions. Instead of granting blanket permissions, AI can evaluate real-time signals like device posture, network environment, risk score, and ‘recent activity to determine whether a request should be approved, denied, or escalated. This is a core component of Zero Trust Architecture.

5. Continuous Compliance Monitoring

AI can continuously audit authorisation configurations against regulatory frameworks (POPIA, HIPAA, GDPR, SOC 2) and automatically flag or even remediate non-compliant policies before they become vulnerabilities.

6. Predictive Risk Scoring

Advanced AI systems can assign risk scores to users, sessions, or access requests based on historical data and contextual signals. High-risk requests can be routed through additional approval workflows or blocked entirely, adding an intelligent layer of defence.

AI is not replacing authorisation. It is making it smarter, faster, and more adaptive. As cloud environments grow more complex, AI-driven authorisation will become essential for maintaining security at scale without sacrificing agility or user experience

Authorisation — Controlling Who Can Do What

Version Control

Originally Published

09 April 2026

Updates

19 April 2026