^{This list is sponsored[0] by:}

Drag and drop your auth.
Add authentication, user management, and authorization to your app with a few lines of code.

---

Trusting is hard. Knowing who to trust, even harder.
— Maria V. Snyder^[1]

IAM stands for Identity and Access Management. It is a complex domain which covers user accounts, authentication, authorization, roles, permissions and privacy. It is an essential pillar of the cloud stack, where users, products and security meets. The other pillar being billing & payments 💰.

This curated list expose all the technologies, protocols and jargon of the domain in a comprehensive and actionable manner.

Contents

• Overview
• Security
• Account Management
• Cryptography
• Identifiers
• Zero-trust Network
• Authentication
• Password-based auth
• Multi-factor auth
• SMS-based
• Password-less auth
• WebAuthn
• Security key
• Public-Key Infrastructure (PKI)
• JWT
• Authorization
• Policy models
• RBAC frameworks
• ABAC frameworks
• ReBAC frameworks
• AWS policy tools
• Macaroons
• Other tools
• OAuth2 & OpenID
• SAML
• Secret Management
• Hardware Security Module (HSM)
• Trust & Safety
• User Identity
• Fraud
• Moderation
• Threat Intelligence
• Captcha
• Blocklists
• Hostnames and Subdomains
• Emails
• Reserved IDs
• Profanity
• Privacy
• Anonymization
• GDPR
• UX/UI
• Competitive Analysis
• History

Overview

In a Stanford class providing an overview of cloud computing, the software architecture of the platform is described as in the right diagram →

Here we set out the big picture: definition and strategic importance of the domain, its place in the larger ecosystem, plus some critical features.

• The EnterpriseReady SaaS Feature Guides - The majority of the features making B2B users happy will be implemented by the IAM perimeter.

• IAM is hard. It's really hard. - “Overly permissive AWS IAM policies that allowed s3:GetObject to * (all) resources”, led to \$80 million fine for Capital One. The only reason why you can't overlook IAM as a business owner.