Role-Based Access Control (RBAC) is the most effective and widely adopted approach for managing authorization in complex environments like the public cloud. RBAC aligns access permissions with the specific job functions and responsibilities of personnel. By assigning users to predefined roles (e.g., database administrator, network engineer, auditor), organizations can systematically enforce the principle of least privilege. This ensures that individuals only have the minimum level of access necessary to perform their duties, significantly reducing the risk of unauthorized access to sensitive resources, data breaches, and accidental misconfigurations. It also simplifies access management and auditing processes.

A. Allowing users to self-assign permissions as needed violates the principle of least privilege and separation of duties, creating a high risk of privilege escalation and unauthorized access.

B. Granting all users the same level of access regardless of their role directly contradicts the principle of least privilege and exposes sensitive resources to unnecessary risk from a larger pool of users.

D. Using a single, shared admin account for all cloud administrators eliminates individual accountability and non-repudiation, making it impossible to trace actions back to a specific person.

1. Cloud Security Alliance (CSA). (2017). Security Guidance for Critical Areas of Focus in Cloud Computing v4.0. Domain 6: Identity

Entitlement

and Access Management

Section 6.2

page 79

states

"Role-based access control (RBAC) is the most common model for managing entitlements. In this model

entitlements are grouped into roles

and users are assigned to those roles."

2. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations. Control AC-2 (Account Management) and its enhancement AC-2(1) emphasize assigning access authorizations based on "formal

documented organizational mission/business functions

" which is the foundational concept of RBAC.

3. Microsoft Azure Documentation. (2023). What is Azure role-based access control (Azure RBAC)?. In its official documentation

Microsoft states

"Azure role-based access control (Azure RBAC) is the authorization system you use to manage access to Azure resources... To grant access

you assign roles to users

groups

service principals

or managed identities at a particular scope." This exemplifies the standard implementation of RBAC by a major cloud provider.

4. Ferraiolo

D. F.

& Kuhn

D. R. (1992). Role-Based Access Control. 15th National Computer Security Conference. This foundational academic paper introduced the RBAC model

defining its core principles of assigning permissions to roles rather than directly to users to enforce organizational security policies. (Available via NIST CSRC publications).