Identity & Access
Narrowing the paths that let someone reach an account that was not theirs - at the front door, in the browser, and in the console.
- Role
- Primary author
- Period
- 2026
- Stack
- AWS Cognito · Oracle CCS · Terraform · IAM · Fastify · TypeScript
Problem
Three separate ways existed to end up somewhere you should not be. Identity verification at registration matched on data thin enough to hit the wrong person. The browser held credentials to talk to the identity provider directly. And engineer and pipeline access to AWS had grown by accretion rather than design.
Constraints
Real utility customers register through this flow, so a fix that locks out legitimate people is not a fix. The portals are multi-tenant and the identity plumbing is shared, so a backend change reaches every tenant.
Decisions
- The registration fix shipped as attempt lockout plus ZIP-based disambiguation, flag-gated so it is enabled tenant by tenant rather than switched on fleet-wide.
- Route permissions moved from scattered checks to one declarative config behind a global guard.
- The team's IAM roles are recorded in Terraform as the source of truth.
Architecture
At the front door: an identity-verification gap enabled account takeover - the last-four plus street match resolved to the wrong person on roughly 2.4% of one tenant's accounts.
In the browser: on most portals, email and password changes now go through the API instead of from the page. A build-time content-security policy injects environment-aware provider URLs, and the real client IP is forwarded to the provider so its adaptive threat protection sees the actual source rather than the load balancer, logging an error when that forwarding falls back.
In the console: every destructive operation is permission-gated, and the recorded IAM roles cover a least-privilege developer policy, per-client task roles, and deploy roles named and documented rather than inherited.
Outcome
- The registration fix ships flag-gated per tenant - attempt lockout and ZIP disambiguation - enabled realm by realm rather than switched on fleet-wide.
- Email and password changes go through the API on most portals, and threat protection sees the true client IP.
- Permissions are declared in one place and enforced by a global guard, and the team's roles live in Terraform.