Lesson 10 — Enterprise Access Governance

Learning Objectives

By the end of this lesson, you will be able to:

Understand Enterprise Access Governance
Learn the principles of Identity Governance and Administration (IGA)
Understand Privileged Access Management (PAM)
Learn identity lifecycle management
Perform enterprise access reviews
Understand audit logging and compliance
Identify governance risks
Apply enterprise access governance best practices

Why This Matters

Enterprise Kubernetes environments may have:

Thousands of employees
Hundreds of developers
Multiple DevOps teams
Third-party contractors
CI/CD pipelines
Automated workloads
Multiple Amazon EKS clusters
Multiple AWS accounts

Without proper governance:

Former employees may retain access.
Developers may accumulate excessive permissions.
Contractors may never be removed.
Privileged accounts may be shared.
Compliance requirements may not be met.

Access Governance ensures that the right people have the right access at the right time—for the right reason.

What is Enterprise Access Governance?

Enterprise Access Governance is the collection of policies, processes and technologies used to control, review, monitor and audit access to systems and data.

It ensures that:

Only authorised identities receive access.
Access is approved.
Access is periodically reviewed.
Access is removed when no longer required.
Privileged activities are audited.

Governance is a continuous process rather than a one-time configuration.

Enterprise Access Governance Architecture

User

↓

Identity Provider

↓

IAM Identity Center

↓

AWS IAM

↓

Amazon EKS

↓

RBAC

↓

Kubernetes Resources

Every access request passes through multiple governance controls before reaching Kubernetes.

Identity Governance and Administration (IGA)

Identity Governance and Administration (IGA) manages the complete lifecycle of user identities.

IGA includes:

User provisioning
Role assignment
Access approvals
Periodic access reviews
Identity certification
Deprovisioning

IGA ensures access remains aligned with business responsibilities.

Identity Lifecycle Management

Every enterprise identity follows a lifecycle.

Join

↓

Provision

↓

Role Assignment

↓

Permission Updates

↓

Periodic Review

↓

Role Change

↓

Offboarding

↓

Access Removed

Access should evolve as employees change roles and should be removed immediately when no longer required.

Joiner, Mover and Leaver (JML)

Most organisations manage access using the JML model.

Lifecycle Stage	Governance Activity
Joiner	Create identity and assign appropriate access
Mover	Update permissions when responsibilities change
Leaver	Remove all access immediately

This process helps reduce stale accounts and excessive permissions.

Role-Based Access Governance

Enterprise access is usually based on predefined job roles.

Example:

Cloud Security Engineer

↓

Security Role

↓

Read Security Hub

Read GuardDuty

View Audit Logs

Review RBAC

Users receive permissions based on their responsibilities rather than individual requests.

Privileged Access Management (PAM)

Privileged accounts require stronger controls than standard user accounts.

Examples include:

Kubernetes Cluster Administrators
AWS Administrators
Security Administrators
Database Administrators
Platform Engineers

These identities have the ability to modify critical infrastructure.

Just-in-Time (JIT) Privileged Access

Permanent administrator access should be avoided.

Instead:

Engineer

↓

Approval

↓

Temporary Admin Role

↓

Time-Limited Access

↓

Automatic Removal

Just-in-Time (JIT) access reduces the attack surface and limits the duration of privileged permissions.

Separation of Duties (SoD)

Critical responsibilities should be divided among multiple individuals or teams.

Example:

Developer

↓

Build Application

------------------------

DevOps Engineer

↓

Deploy Application

------------------------

Security Engineer

↓

Approve Security Controls

------------------------

Platform Team

↓

Manage Cluster

No single person should control the entire deployment lifecycle.

Access Approval Workflow

Enterprise organisations often require approvals before granting privileged access.

User Requests Access

↓

Manager Approval

↓

Security Approval

↓

IAM Role Assigned

↓

Amazon EKS Access

Approval workflows improve accountability and reduce unauthorised privilege assignments.

Periodic Access Reviews

Access should be reviewed regularly.

Review process:

Review Users

↓

Review IAM Roles

↓

Review RBAC

↓

Remove Unused Permissions

↓

Document Changes

Quarterly and annual reviews are common for production environments.

Identity Certification

Managers and system owners periodically certify that users still require their assigned access.

Example:

Finance Manager

↓

Review Finance Team Access

↓

Approve

or

Revoke

Identity certification is a common compliance requirement.

Audit Logging

Every privileged action should be recorded.

Examples include:

User logins
RBAC changes
IAM policy changes
ClusterRoleBinding creation
Secret access
Namespace deletion
Service Account creation
IRSA role assumptions

Comprehensive audit logs support investigations and compliance reporting.

Governance Monitoring Architecture

User Activity

↓

AWS CloudTrail

↓

Kubernetes Audit Logs

↓

Amazon CloudWatch

↓

AWS Security Hub

↓

SOC Team

Security teams monitor governance events continuously.

Compliance Frameworks

Access Governance supports compliance with many industry standards.

Common frameworks include:

ISO/IEC 27001
SOC 2
PCI DSS
HIPAA
NIST Cybersecurity Framework (CSF)
NIST SP 800-53
CIS Kubernetes Benchmark
CIS AWS Foundations Benchmark

These frameworks require organisations to demonstrate effective access controls and auditing.

Enterprise Example

A global financial institution operates multiple Amazon EKS clusters.

Access model:

Developer

↓

IAM Identity Center

↓

Developer IAM Role

↓

Development Namespace

------------------------

Security Engineer

↓

Security IAM Role

↓

Read Audit Logs

↓

Review RBAC

------------------------

Platform Administrator

↓

Temporary PAM Role

↓

Cluster Administration

Every privileged action is logged using:

AWS CloudTrail
Kubernetes Audit Logs
Amazon GuardDuty
AWS Security Hub

Quarterly access reviews ensure permissions remain appropriate.

Common Governance Risks

Cloud Security Engineers frequently discover:

Shared administrator accounts
Stale employee accounts
Contractors retaining access
Excessive IAM permissions
Overprivileged RBAC roles
Missing approval workflows
No access reviews
Permanent administrator privileges
Unmonitored privileged activity
Incomplete audit logging

These issues increase the likelihood of unauthorised access and compliance failures.

Enterprise Monitoring

Security teams should monitor:

New administrator accounts
Failed authentication attempts
IAM Role creation
IAM policy changes
RBAC modifications
Privilege escalation attempts
Access review completion
JIT access requests
Service Account changes
High-risk administrative actions

Monitoring provides visibility into changes that could impact the security of the Kubernetes environment.

Governance Best Practices

As a Kubernetes Security Engineer:

Integrate Amazon EKS with IAM Identity Center.
Implement Identity Governance and Administration (IGA).
Follow the Joiner-Mover-Leaver (JML) process.
Use Role-Based Access Control (RBAC).
Apply the Principle of Least Privilege.
Implement Privileged Access Management (PAM).
Use Just-in-Time (JIT) administrative access.
Conduct periodic access reviews.
Enable comprehensive audit logging.
Remove unused identities and permissions promptly.

Governance should be embedded into daily operations rather than treated as an annual compliance exercise.

Real-World Scenario

An employee leaves an organisation after working as a Platform Engineer.

Because the offboarding process fails:

Their IAM account remains active.
Their Kubernetes RBAC permissions remain unchanged.
Their VPN account is still enabled.

Months later, the employee’s credentials are compromised.

An attacker:

Authenticates to AWS.
Accesses Amazon EKS.
Creates privileged Pods.
Reads Kubernetes Secrets.
Disables monitoring.

Following the incident, the organisation implements:

Joiner-Mover-Leaver lifecycle management
IAM Identity Center integration
Quarterly access reviews
Just-in-Time privileged access
Automated account deprovisioning
Continuous audit monitoring

These governance improvements significantly reduce the risk of stale identities and unauthorised access.

Key Takeaways

After completing this lesson, you should understand:

What Enterprise Access Governance is
The purpose of Identity Governance and Administration (IGA)
Identity lifecycle management using the Joiner-Mover-Leaver model
The importance of Privileged Access Management (PAM)
Just-in-Time (JIT) privileged access
Access reviews and identity certification
Audit logging and compliance
Enterprise governance best practices

Enterprise Access Governance ensures that access to Amazon EKS is continuously controlled, reviewed, monitored and audited. Strong governance reduces security risk, supports regulatory compliance and protects critical Kubernetes infrastructure from unauthorised access.

Knowledge Check

Question 1

What is the primary goal of Enterprise Access Governance?

A. Increase Kubernetes performance
B. Ensure the right identities have the right access at the right time
C. Replace RBAC
D. Encrypt Kubernetes Secrets

Answer: B

Question 2

Which lifecycle model is commonly used for enterprise identity management?

A. CI/CD
B. JML (Joiner, Mover, Leaver)
C. DevSecOps
D. OIDC

Answer: B

Question 3

Which security practice provides temporary administrative access instead of permanent privileges?

A. Static IAM Users
B. Just-in-Time (JIT) Access
C. Anonymous Authentication
D. Shared Administrator Accounts

Answer: B

Question 4

Which AWS service records API activity and supports governance auditing?

A. Amazon ECR
B. AWS CloudTrail
C. Amazon Route 53
D. AWS Lambda

Answer: B

Question 5

Which of the following is considered an enterprise governance best practice?

A. Share administrator accounts across teams.
B. Grant permanent cluster-admin access to all developers.
C. Perform periodic access reviews and remove unnecessary permissions.
D. Disable audit logging to reduce storage costs.

Answer: C

Module 02 Summary

Congratulations! 🎉

You have successfully completed Module 02 — Kubernetes Identity & Access Management.

You now understand:

Kubernetes Authentication
Kubernetes Authorization
Role-Based Access Control (RBAC)
Kubernetes Service Accounts
Kubernetes Secrets
Identity Federation
IAM Roles for Service Accounts (IRSA)
Least Privilege Design
Kubernetes Multi-Tenant Security
Enterprise Access Governance

These topics form the identity and access management foundation for securing enterprise Kubernetes environments. In the next module, you will build on this knowledge by securing communication between workloads, controlling network traffic, and implementing Zero Trust networking within Kubernetes.

➡️ Next Module: Module 03 — Kubernetes Network Security