RBAC for a Fintech: Least-Privilege IAM Policies

<p>Kosh Finance, a fictional Mumbai lending and payouts start-up, still runs on one shared admin login. Its partner bank wants named roles with least privilege before it renews the contract.</p><p>In four lessons you learn how access control models work (DAC, RBAC, ABAC), how AWS-style IAM policies are evaluated (explicit deny, allow, implicit deny), how conditions add MFA, amount limits and network restrictions, and how separation of duties keeps one person from both creating and approving a payout. You write a policy for each of four roles in Bartman's in-browser Identity Console and test them in its policy simulator.</p><p>Hidden test requests, generated for your account, bucket, limit and office network, check every role: what must be allowed and what must be refused. Part of the Bartman Cybersecurity track (Professional Certificate in Cybersecurity, LSBF).</p>

Tools: IAM, RBAC, Least privilege, Policy as code, MFA, Separation of duties