Comparison
Instance metadata servicevsWorkload identity
Instance metadata service
an internal HTTP endpoint hands out the machine's cloud credentials to anything running on it that can make a request.
The link-local endpoint from which an instance retrieves its identity and temporary credentials. It is the mechanism that makes credential-free workloads possible and a notorious escalation path, because a server-side request forgery in an application can reach it and read the credentials. The defences are the session-based version that resists simple forgery, blocking pod-level access, and keeping instance roles minimal.
Full entry →Workload identity
the service proves what it is to the cloud without holding any credential, because the platform attests to it.
Giving a running workload a cryptographic identity derived from where and what it is, which other systems can verify, instead of a shared secret it must carry. It is what eliminates long-lived keys in application configuration and what makes mutual TLS between services possible without a certificate distribution problem. It also makes authorisation legible, since policies name the service rather than an opaque key.
Full entry →