身份與存取管理（IAM）

// ASP.NET Core — 用 Managed Identity 存取 Azure 資源（零密鑰管理）
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
 
// DefaultAzureCredential 自動偵測環境
// 本機開發：用 Azure CLI 登入的身份
// 雲端環境：用 Managed Identity
var credential = new DefaultAzureCredential();
 
// 從 Key Vault 取得密鑰 — 不需要在程式碼中寫任何 Secret
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), credential);
var secret = await client.GetSecretAsync("database-connection-string");
var connectionString = secret.Value.Value;
 
// 用 Managed Identity 存取 SQL Database
builder.Services.AddDbContext<AppDbContext>(options =>
{
    options.UseSqlServer(connectionString);
});
 
// RBAC — 在程式碼中檢查使用者角色
[Authorize(Roles = "Admin")]
[HttpDelete("api/users/{id}")]
public async Task<IActionResult> DeleteUser(int id)
{
    // 只有 Admin 角色能刪除使用者
    await _userService.DeleteAsync(id);
    return NoContent();
}
 
[Authorize(Policy = "CanManageOrders")]
[HttpPut("api/orders/{id}")]
public async Task<IActionResult> UpdateOrder(int id, UpdateOrderDto dto)
{
    await _orderService.UpdateAsync(id, dto);
    return NoContent();
}

// AWS IAM — Terraform 定義角色和策略

# IAM Role for Lambda Function
resource "aws_iam_role" "lambda_role" {
  name = "order-processor-role"
 
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = { Service = "lambda.amazonaws.com" }
    }]
  })
}
 
# 最小權限策略 — 只允許讀取特定 S3 Bucket 和寫入特定 DynamoDB Table
resource "aws_iam_role_policy" "lambda_policy" {
  role = aws_iam_role.lambda_role.id
 
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["s3:GetObject"]
        Resource = "arn:aws:s3:::order-bucket/*"
      },
      {
        Effect   = "Allow"
        Action   = ["dynamodb:PutItem", "dynamodb:UpdateItem"]
        Resource = "arn:aws:dynamodb:*:*:table/Orders"
      }
    ]
  })
}

# Azure SDK — 用 Managed Identity 存取資源
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient
from azure.mgmt.authorization import AuthorizationManagementClient
 
credential = DefaultAzureCredential()
 
# 從 Key Vault 取密鑰
secret_client = SecretClient(
    vault_url="https://myvault.vault.azure.net/",
    credential=credential
)
db_password = secret_client.get_secret("db-password").value
 
# 列出角色指派（用於 Access Review）
auth_client = AuthorizationManagementClient(credential, subscription_id)
assignments = auth_client.role_assignments.list_for_scope(
    scope=f"/subscriptions/{subscription_id}/resourceGroups/myapp-rg"
)
 
for assignment in assignments:
    print(f"Principal: {assignment.principal_id}, Role: {assignment.role_definition_id}")