Enterprise Identity and Access Management Architect

Wrote docs/architecture/identity-access-architect/00-overview/identity-access-architect-overview.md and docs/architecture/identity-access-architect/verification/fitness-self-check.md. Complete enterprise identity and access architecture specifying Okta SSO federation to AWS IAM Identity Center, FIDO2 hardware MFA, SCIM 2.0 automated deprovisioning, and ephemeral credential governance.

---

skill: identity-access-architect

Identity & Access Architecture: Global FinTech Banking Group [IAM-BANK-001]

Summary

This specification establishes the enterprise workforce identity governance, Single Sign-On (SSO) federation, and Privileged Access Management (PAM) architecture for the Global FinTech Banking Group under run ID bank-iam-arch-001. It governs 4,800 employees across 65 AWS cloud accounts and hybrid trading networks. It decisively eliminates the credential theft and persistent access vectors demonstrated in incident INC-4929 (where an SMS-swapped credential compromised an administrator account and lingered undetected for 12 days). The architecture enforces a centralized Okta Identity Provider (IdP) federated via SAML 2.0 / OIDC to AWS IAM Identity Center, mandatory phishing-resistant FIDO2 / WebAuthn hardware tokens, automated SCIM 2.0 employee deprovisioning within 15 minutes of HR termination events, zero static long-lived IAM credentials (100% ephemeral STS tokens capped at 1 hour), and dual-custody break-glass PAM governance.

Detailed Description

Relying on decentralized static credentials (AWS_ACCESS_KEY_ID) and SMS-based OTP authentication creates massive attack surfaces in regulated financial institutions. When employees depart or change roles, orphaned static keys linger indefinitely in configuration files and CI runners. Centralized identity architecture binds all corporate access to a single authoritative identity source, enforcing continuous risk-based authentication and automated lifecycle synchronization.

Corporate Employee / Trader Login (4,800 Users)
                        │
                        ▼ (Phishing-Resistant WebAuthn Challenge)
[ Central Enterprise IdP: Okta Universal Directory ]
  ├── 1. Mandatory FIDO2 / YubiKey Hardware Token Assertion
  ├── 2. Device Posture & Context Gate (CrowdStrike Zero-Trust Score >= 80)
  └── 3. SCIM 2.0 Ingestion: Workday HR System of Record
                        │
       ┌────────────────┴────────────────┐
       ▼ (SAML 2.0 / OIDC Federation)    ▼ (Privileged Escalation)
[ AWS IAM Identity Center ]       [ CyberArk Enterprise PAM ]
  ├── Permission Sets (Least Privilege)   ├── Dual-Authorization Approval
  └── Short-Lived Ephemeral STS Tokens    └── 60-Minute Session Recording
        (1-Hour Session Max)                    │
        │                                       ▼
        ▼                                 [ Cloud Root / Break-Glass ]
[ 65 Multi-Tenant Workload AWS Accounts ]

Mechanism Specifications

1. Trust Boundary & Network Enforcement:

   • Owner: Marcus Vance (Head of Enterprise Infrastructure).
   • Trigger: User authentication attempt or federated token exchange request.
   • State/Algorithm: Ingress into AWS management consoles and production workloads requires mutual TLS or TLS 1.3 session established via Okta SSO and AWS IAM Identity Center. Direct network ingress to cloud control planes bypassing IdP is blocked.
   • Failure Behavior: Connection attempts lacking valid SAML assertion or OIDC bearer token return HTTP 401 Unauthorized and trigger SecOps anomalous ingress logging.
   • Test Oracle: Automated network boundary probe verifying zero unauthenticated control plane routes across all 65 accounts.

2. Authorization Policy & Principle of Least Privilege:

   • Owner: David O'Reilly (Chief Information Security Officer).
   • Trigger: AWS API call execution or role assumption.
   • State/Algorithm: AWS IAM Identity Center permission sets enforce strict role-based and attribute-based access control. All human roles receive ephemeral AWS STS credentials with maximum duration of 3,600 seconds (1 hour). Static IAM user credentials (AKIA...) are blocked by root-level Service Control Policies (SCPs).
   • Failure Behavior: API calls exceeding granted permission set return HTTP 403 AccessDenied and generate CloudTrail security event.
   • Test Oracle: Automated policy simulation verifying zero human roles possess wildcards (*:*) or static API keys.

3. Threat-Control Mapping & Automated Deprovisioning:

   • Owner: David O'Reilly / SecOps.
   • Trigger: Workday HR termination webhook or employee role change event.
   • State/Algorithm: Workday HR publishes termination event to Okta SCIM 2.0 listener. Okta immediately revokes all active web sessions, invalidates OAuth refresh tokens, and calls AWS IAM Identity Center SCIM endpoint to mark user SUSPENDED in < 3 minutes. Total end-to-end deprovisioning occurs within 15 minutes.
   • Failure Behavior: If SCIM endpoint sync fails, automated alert dispatches to on-call security engineer; user account is quarantined via fallback API script within 5 minutes.
   • Test Oracle: Synthetic leaver probe measuring elapsed time between Workday termination event and complete AWS STS session invalidation.

4. Credential Lifecycle & Key Rotation:

   • Owner: Infrastructure Platform & Security Engineering.
   • Trigger: Credential issuance epoch or 1-hour expiration timer.
   • State/Algorithm: 100% of human developer and administrator credentials are short-lived STS tokens issued by AWS IAM Identity Center with a 3,600-second hard ceiling. Machine-to-machine service roles authenticate via IAM Roles for Service Accounts (IRSA) with automated 24-hour token rotation.
   • Failure Behavior: Expired tokens fail closed; SDKs must automatically re-authenticate against active SSO session.
   • Test Oracle: Continuous compliance query verifying zero active IAM credentials with age > 1 hour for human identities.

Alternatives rejected

Contracts and Invariants

Zero Static IAM Access Key Invariant [INV-IAM-01]
  Workforce human users must not possess static IAM access keys (`AKIA...`).
  All cloud access must be negotiated via Okta SSO and AWS IAM Identity Center ephemeral STS tokens.

Mandatory FIDO2 Hardware Token Invariant [INV-IAM-02]
  Access to internal banking systems and cloud consoles requires phishing-resistant FIDO2 hardware MFA.
  Authentications originating from SMS or voice OTP are blocked by Okta Sign-On policies.

Fifteen-Minute Deprovisioning Guarantee [INV-IAM-03]
  A user termination event in Workday must cascade to complete suspension across all 65 AWS accounts
  within 15 minutes. Un-synchronized accounts trigger compliance breach escalations.

Two-Hour Privileged Access Ceiling [INV-IAM-04]
  Break-glass production elevation through CyberArk PAM must not exceed 120 minutes.
  Sessions terminate automatically, credentials rotate immediately, and full session video is archived.

Ownership and Handoffs

Explicit Unknowns

• SCIM API rate limit ceilings during mass corporate restructuring events (G-1).
• Offline emergency break-glass procedure when corporate Okta IdP experiences global cloud outage (G-2).

Traceability

Verification

No validator was supplied, so no command was run.

Reviewer self-check against identity and access standards:

• Credential Safety: PASS. Zero static IAM keys; all access mediated via ephemeral 1-hour STS tokens.
• MFA Rigor: PASS. Phishing-resistant FIDO2 hardware tokens required; SMS/OTP disabled.
• Deprovisioning Speed: PASS. Real-time SCIM 2.0 synchronizes HR terminations in < 15 minutes.
• Markdown Hygiene: PASS. Native Markdown syntax strictly adheres to rule_markdown.md.

Open Decisions

• DEC-IAM-01: David O'Reilly to determine whether Entra ID Privileged Identity Management (PIM) should be deployed as a secondary backup PAM provider for Azure DR environments (Owner: David O'Reilly).

---

skill: identity-access-architect

Global FinTech Banking Group IAM — Fitness Self-Check [IAM-FIT-001]

Summary

This fitness self-check evaluates the identity and access architecture for Global FinTech Banking Group against the three red-capable domain failure probes: authentication-as-authorization, unrotated secrets, and control without evidence. All targeted probes pass by design construction. A self-check is supporting evidence, never the authoritative gate. Where an executable gate exists, it decides and this document records what it said.

Detailed Description

Residual Risk

• Temporary cellular network roaming latency during international travel may cause 3–5 second delays during WebAuthn FIDO2 attestation challenges. Accepted by Marcus Vance with client-side retry timeout configured to 15 seconds.

Traceability

Verification

No validator was supplied, so no command was run.

Open Decisions

None.

Next steps

1. Marcus Vance provisions AWS IAM Identity Center and connects Okta SAML/SCIM applications.
2. Security team distributes YubiKey 5 hardware tokens and enforces WebAuthn policy in Okta.
3. Conduct staging game day simulating HR termination to verify automated account deprovisioning within 15 minutes.
4. CISO David O'Reilly verifies first automated 24-hour PAM break-glass audit logs in central security repository.