This presentation will cover the concepts and tooling for wrangling identity, access management, and secrets (passwords, ssl certificates, access tokens, etc.) in cloud services. In identity, we will cover methods of handling Single Sign On (SSO) for services and user management in services that don't support SSO. With access control, we will cover methods of limiting access to services and infrastructure, methods of controlling access to secrets, including secure methods of bootstrapping authentication for secret management, and methods of limiting access to docker containers in both multi-tenant and non-multitenant environments.

You will leave this presentation understanding the methods for handling various types of security problems in cloud services as well as the tools we use at Lyft including Google SAML/OAuth2, Onelogin and Octa for identity management/SSO, Confidant, Vault, Sneaker, Credstash and Keywhiz for secret management, Confidant and KMS for secure bootstrapping, and metadataproxy and ec2metaproxy for limiting access to docker containers.