Make identity & access part of your automation, not an afterthought
The DevOps best practice to inject security controls is to “Shift Left”. When you look at the entire software development lifecycle as a series of automated processes moving from left to right, you want to add security as early on where the Developers and Operations Engineers are configuring the automation. In other words – add security controls while the humans are still involved, so once the machines take over, the right guard rails are in place.
Given that Identity & Access is such a critical security component for application developers and systems administrators alike, the best practice is to “Shift Identity Left” – injecting IAM controls early on in the process. This applies to both application developers writing code, and systems administrators declaring infrastructure as code.