---
title: "Identity & access — N1 IT Landscape"
---

N1 IT Landscape — The Blueprint · CF-Access internal

# Identity & access

N1 IT Landscape · Owner: Arun Venkataraman · source of truth: markdown SSOT

# N1 IT Landscape — Identity & access

> **CURRENT-STATE** as of **2026-06-09** · part of the **N1 IT Landscape** (start at **[Overview](/landscape/overview/)**). Owner: **Arun Venkataraman** (Principal Engineer).

_How everyone signs in: Google Workspace as the master identity, Cloudflare Access + WARP as the front door, mandatory 2FA, and AWS access._

* * *

## 4\. IDENTITY & ACCESS MANAGEMENT (the master key)

**Google Workspace is the single master identity provider (IdP) for everything.** Almost every other system federates to Google.

### 4.1 Google Workspace

Tier | Who | Why  
---|---|---  
**Business Standard** | Arun and the CEO | More protected / more capable accounts (admins, highest-risk identities)  
**Business Starter** | Everyone else | Standard staff mailbox + identity  
  
Google Workspace is the **IdP of record** : it backs Cloudflare Access sign-in, AWS sign-in, GitHub (via the people who use Google to authenticate), and the product's "Sign in with Google".

### 4.2 Cloudflare Access / Cloudflare One (the front door to everything internal)

N1 runs **Cloudflare's Zero-Trust suite** (branded "Cloudflare One" / "Cloudflare Access") on the **free Zero-Trust plan** — appropriate for a team this small.

  * **WARP client** (Cloudflare's VPN/device agent) is installed on every machine and is **always-on**.
  * To reach anything internal you must be signed in with your **company Google account** through WARP. Without it, **no internal resource resolves or responds**.
  * The staging databases are exposed to the team read-only through Cloudflare's private DNS — see [§6.7](/landscape/cloudflare/) (`db.staging.n1` and `redis.staging.n1`).

Cloudflare Access has **exactly one identity provider configured: Google OAuth** ("N1 Healthcare", PKCE enabled). WARP device enrollment uses that same Google IdP — there is no separate WARP or one-time-PIN identity source. WARP is the device-posture layer on top of the Google identity.

### 4.3 Two-factor authentication (2FA) — mandatory for all

Group | Allowed second factor  
---|---  
Onsite team | **YubiKeys** (hardware)  
Remote team | **YubiKeys** _or_ **Google Authenticator** app  
  
  * 🔒 **GitHub enforces org-wide 2FA** (verified: `two_factor_requirement_enabled = true`).
  * AWS sign-in is via Google IdP + permission sets, so it inherits Google's 2FA.

### 4.4 Credential management

  * **Dashlane** is the staff credential manager. 🔒 It is **not connected to Google** — it is a separate vault so that a Google compromise does not also surrender the password vault.

### 4.5 AWS access

  * AWS sign-in is through **AWS IAM Identity Center** federated to **Google** , granting **permission sets** (verified roles: `AdministratorAccess`, `PowerUserAccess`). Only **Arun, Eyad, Darpan** have AWS access. The management account holds IAM Identity Center + billing ([§8.1](/landscape/aws/)).

* * *