Create Account Object

[Aniak5]

Currently account attributes are used inconsistently within a variety of objects (Cloud, User, Resource) as can be seen in image below:

The account_name attribute would be useful in the user object in the case that we have the full users name as well as their account name (ex: John Doe and jdoe). For consistency, lets create an account object that contains name, type, type_id, uid within it and replace account fields with this one object.

If we decide to create the account object then we should also update the cloud, user and resource objects to use this new account object.

Note: This is a breaking change.

[floydtree]

Interesting, I don't see the inconsistency that you refer to. From your description, it appears account_name is a field that you would want to add the user object which is currently missing. All other fields are present in objects as and where necessary.

I think, we should be extra cautious around breaking changes to the schema. A quick non-breaking change would be to add account_name to the user object if you have/foresee a use-case for it.

At this point in time, I don't have a strong preference for this change, I would be okay with the way it is today(with the said addition to user object). The primary questions from me are, do we require another layer of nesting for these fields? What contextual benefit do we add to the schema by nesting these fields further down an object? Is that a worthy/necessary breaking change?

[rroupski]

Take a look at the picture above to see how the account_xyz attributes are used. For example, most of the objects don't have the account_type. Why the cloud object does not have an account_type? Is it AWS account, GCP Account, or Azure AD Account?

Also, having 4 attributes with the same prefix begs for an new object.

[floydtree]

Is it AWS account, GCP Account, or Azure AD Account?

That is not an account_type, cloud.provider is how that information is conveyed.
Likewise, why would resource object require an account_type?

And of course, my comments were after looking at the image. I still stand by my initial comments & questions.

[pagbabian-splunk]

I think the main issue for me is the distinction between a User as an entity, security principal, and account under which some process is running. Often a User has an Account, a Process runs-as a User but in reality is running under the user's account. If there are attributes today prefixed with account_ then where and how are they used?

[irakledibm]

We had internal IBM discussion about User and Account object. I will be creating proposal to make few changes to a User Object and I will be adding to this proposal our view of the Account Object.

[JasonKeirstead]

Worth reading: https://cloudstudio.com.au/2021/05/29/account-structure-aws-vs-azure/

[pagbabian-splunk]

Account is part of RC3.