Fleet Engine security design

Now that you read the basics about account roles and JWTs in Fleet Engine, you can review this section to understand the basic flow of authentication and authorization operations in Fleet Engine.

Security design

Fleet Engine's security design is comprised of the following elements:

  • Roles:
    • IAM roles define the scope of allowed activity for the caller. For example, the ondemandAdmin or deliveryAdmin role is allowed to do everything, whereas the driverSdkUser or deliveryUntrustedDriver role may only perform minimal location updates.
    • IAM roles are associated with service accounts.
  • Requests
    • JWT claims further restrict the entities that the caller may operate on. These can be specific tasks or delivery vehicles.
    • Requests sent to Fleet Engine always contain a JWT.
    • Since JWTs are associated with service accounts, requests sent to Fleet Engine are implicitly associated with the service account associated with the JWT.
    • In order to request the appropriate JWT that you can then pass to Fleet Engine, your code running in a low-trust environment must first call on your code running in a fully trusted environment.
  • Security checks by Fleet Engine
    • IAM roles associated with the service account provide the correct authorization for the caller to issue the API call.
    • The JWT claims passed in the request provide the correct authorization for the caller to operate on the entity.

Client app authentication flow

The following sequence diagram demonstrates these client app authentication flow details.

  • The fleet administrator sets up accounts as follows:
    • Creates service accounts
    • Assigns specific IAM roles to the service accounts
    • Configures their backend with the service accounts
  • The client app requests a JWT from your server. The requester could be the Driver app, the Consumer app, or a monitoring app.
  • Fleet Engine issues a JWT for the respective service account.
  • The client app does the following:
    • Receives the JWT
    • Uses the JWT to connect to Fleet Engine to read or modify data, depending on the IAM roles assigned to it during setup phase.

Diagram of the security flow during setup for client app authentication

What's next