Comparison
Certificate rotationvsWorkload identity
Certificate rotation
everything worked for a year and then stopped at once on a Sunday, because a certificate nobody owned had expired.
Replacing TLS certificates before they expire, ideally automatically. Expiry is a uniquely predictable outage that keeps happening because it is invisible until the day, the owner has often left, and internal certificates are excluded from the external monitoring that would have caught it. Short-lived automatically-renewed certificates are strictly safer, because a renewal path exercised daily is one you know works.
Full entry →Workload identity
the service proves what it is to the cloud without holding any credential, because the platform attests to it.
Giving a running workload a cryptographic identity derived from where and what it is, which other systems can verify, instead of a shared secret it must carry. It is what eliminates long-lived keys in application configuration and what makes mutual TLS between services possible without a certificate distribution problem. It also makes authorisation legible, since policies name the service rather than an opaque key.
Full entry →