Role-based access control in Microservices - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Role-based Access Control (RBAC)?

RBAC is a method to restrict system access to authorized users based on their roles. Each role has specific permissions, and users get access by being assigned roles.

intermediate

In a microservices architecture, where is RBAC typically enforced?

RBAC can be enforced at the API gateway, service level, or both. The gateway can check user roles before forwarding requests, and services can verify permissions for sensitive operations.

beginner

What are the main components of RBAC?

The main components are: Users (people or systems), Roles (job functions or titles), Permissions (allowed actions), and Sessions (user interactions with assigned roles).

intermediate

How does RBAC improve security in a distributed system?

RBAC limits access to only what users need, reducing risk of unauthorized actions. It simplifies management by grouping permissions into roles instead of assigning individually.

advanced

What is a common challenge when implementing RBAC in microservices?

A common challenge is keeping role and permission data consistent across services. This often requires a centralized identity and access management system or shared policy service.

What does RBAC stand for?

A Rule-based Access Control

B Resource-based Access Control

C Role-based Authorization Code

D Role-based Access Control

RBAC stands for Role-based Access Control, a method to manage user permissions based on roles.

In RBAC, what is assigned to users to grant permissions?

A Passwords

B Roles

C Tokens

D Sessions

Users are assigned roles, and roles have permissions that define what actions users can perform.

Where is RBAC enforcement commonly implemented in microservices?

A API Gateway

B Database only

C Frontend UI only

D Network router

RBAC is often enforced at the API Gateway to filter requests before they reach services.

Which is NOT a main component of RBAC?

A Encryption keys

B Roles

C Permissions

D Users

Encryption keys are unrelated to RBAC components, which focus on users, roles, and permissions.

What is a key benefit of using RBAC?

A Removes need for logging

B Eliminates need for authentication

C Simplifies permission management

D Allows all users full access

RBAC simplifies permission management by grouping permissions into roles.

Explain how Role-based Access Control works in a microservices system.

Think about how users get access and where checks happen.

Describe challenges and solutions for implementing RBAC across multiple microservices.

Consider how multiple services share access rules.