How to Operationalize Access Policies for Multiple Clouds

on YouTube ↗40m

" summary

Describes a concrete standard and working software: IDQL five-tuple represents subject action resource scope conditions, and the Hexa orchestrator discovers cloud policies, translates to IDQL, edits JSON, and pushes back to targets. Demonstrations show live GCP Identity‑Aware Proxy updates, OPA evaluating IDQL via Rego, and round‑trip mapping to AWS Cedar / Verified Permissions — three demos that succeed. Architecture uses provider packages and three integration methods (API, language translation, OPA JSON ingestion) and is a CNCF Sandbox open source project.

AI-written summary · about

" chapters (13)

1. 0:00RSAConference 2023
2. 2:41Hexa and IdentityQL (IDQL)
3. 3:21Identity and policy is fragmented
4. 6:54Hexa - Open source to operationalize IDQL
5. 8:05Hexa provider interface architecture
6. 10:11Hexa mapping techniques
7. 15:27Basic integration with GCP
8. 20:26Integration with Open Policy Agent (OPA)
9. 24:41Demo 2 setup
10. 31:34Benefits of Policy Orchestration with IDQL and Hexa
11. 33:20Questions to ponder
12. 34:22A call to (policy) action
13. 35:21Hexa project information

" related talks

• 31mAccess Policies for Hybrid Cloud EnvironmentsRuiyi Wang · KubeCon + CloudNativeCon China 2018
• 39mAddressing Cloud Security with OPAJosh Stella · Conf42 Open Source Showcase 2020
• 42mDesign Patterns for OPA and Cloud Native AuthorizationTim Hinrichs · CloudOpen @ Open Source Summit North America 2022
• 36mOPA for the cloud nativesPhilipp Krenn · Voxxed Days Ticino 2023
• 41mTaking Command of Cloud Security with OPAJosh Stella · DevOpsDays Raleigh 2020
• 38mOPA for the cloud nativesPhilipp Krenn · DevOpsDays Warsaw 2022
• 36mDynamic and Context-Aware Security Policies for the Cloud Using...Julian Stephen, Shriti Priya · CloudOpen @ Open Source Summit North America 2023
• 48mBeyond Entitlements for the Cloud NativeChandra Guntur · Developer Summit 2020