Access Control
Access control is the technique that determines who can access a resource. In terms of data access control, accessing the resource can include viewing, modifying, and destroying the data.
In most cloud environments, the definition of “who” can include both people and other resources. For example, you may have a payroll application that needs to access secure data about employees that is stored in a database. There must be access control rules in place that permit or block access for both people and resources.
People are given user accounts to access cloud resources. These user accounts are granted access to resources by using permissions.
Applications are assigned to roles, which are similar to user accounts in that permissions can be applied to roles just as they are applied to user accounts. However, applications can never be assigned to user accounts (in some cases a user may be assigned to a role, depending on the cloud environment that you are working in).
To learn more about how user accounts and roles impact access to resources, see Chapter 5, “Identity and Access Management.”