Identity and access Required

Sign people in through single sign-on

Give people cloud access only through the company identity provider, with two-factor login. Create no separate cloud user with a password for a person.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Connect the cloud to the identity provider, for example with AWS IAM Identity Center, Google Cloud's Workforce Identity or Microsoft Entra ID. Map groups to roles, such as read-only, developer and admin. Require phishing-resistant factors, passkeys or security keys, as in two-factor login. Set the session length of production roles to 1 hour, because credentials already issued stay valid until they expire. When someone leaves, removing them from the identity provider then ends all their cloud access within that hour.

Example

# AWS: lists users that have a console password. Expect only the documented break-glass users.
aws iam generate-credential-report >/dev/null && sleep 5
aws iam get-credential-report --query Content --output text | base64 -d | awk -F, 'NR>1 && $4=="true" {print $1}'

How to check

The cloud lists no human user with a console password. Disable a test person in the identity provider, and their next cloud call fails within 1 hour.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/identity-and-access/single-sign-on-for-people.