Identity & access — N1 IT Landscape
N1 IT Landscape — The Blueprint · CF-Access internal
Identity & access
Section titled “Identity & access”N1 IT Landscape · Owner: Arun Venkataraman · source of truth: markdown SSOT
N1 IT Landscape — Identity & access
Section titled “N1 IT Landscape — Identity & access”CURRENT-STATE as of 2026-06-09 · part of the N1 IT Landscape (start at Overview). Owner: Arun Venkataraman (Principal Engineer).
How everyone signs in: Google Workspace as the master identity, Cloudflare Access + WARP as the front door, mandatory 2FA, and AWS access.
4. IDENTITY & ACCESS MANAGEMENT (the master key)
Section titled “4. IDENTITY & ACCESS MANAGEMENT (the master key)”Google Workspace is the single master identity provider (IdP) for everything. Almost every other system federates to Google.
4.1 Google Workspace
Section titled “4.1 Google Workspace”| Tier | Who | Why |
|---|---|---|
| Business Standard | Arun and the CEO | More protected / more capable accounts (admins, highest-risk identities) |
| Business Starter | Everyone else | Standard staff mailbox + identity |
Google Workspace is the IdP of record : it backs Cloudflare Access sign-in, AWS sign-in, GitHub (via the people who use Google to authenticate), and the product’s “Sign in with Google”.
4.2 Cloudflare Access / Cloudflare One (the front door to everything internal)
Section titled “4.2 Cloudflare Access / Cloudflare One (the front door to everything internal)”N1 runs Cloudflare’s Zero-Trust suite (branded “Cloudflare One” / “Cloudflare Access”) on the free Zero-Trust plan — appropriate for a team this small.
- WARP client (Cloudflare’s VPN/device agent) is installed on every machine and is always-on.
- To reach anything internal you must be signed in with your company Google account through WARP. Without it, no internal resource resolves or responds.
- The staging databases are exposed to the team read-only through Cloudflare’s private DNS — see §6.7 (
db.staging.n1andredis.staging.n1).
Cloudflare Access has exactly one identity provider configured: Google OAuth (“N1 Healthcare”, PKCE enabled). WARP device enrollment uses that same Google IdP — there is no separate WARP or one-time-PIN identity source. WARP is the device-posture layer on top of the Google identity.
4.3 Two-factor authentication (2FA) — mandatory for all
Section titled “4.3 Two-factor authentication (2FA) — mandatory for all”| Group | Allowed second factor |
|---|---|
| Onsite team | YubiKeys (hardware) |
| Remote team | YubiKeys or Google Authenticator app |
- 🔒 GitHub enforces org-wide 2FA (verified:
two_factor_requirement_enabled = true). - AWS sign-in is via Google IdP + permission sets, so it inherits Google’s 2FA.
4.4 Credential management
Section titled “4.4 Credential management”- Dashlane is the staff credential manager. 🔒 It is not connected to Google — it is a separate vault so that a Google compromise does not also surrender the password vault.
4.5 AWS access
Section titled “4.5 AWS access”- AWS sign-in is through AWS IAM Identity Center federated to Google , granting permission sets (verified roles:
AdministratorAccess,PowerUserAccess). Only Arun, Eyad, Darpan have AWS access. The management account holds IAM Identity Center + billing (§8.1).