Comparison
Service accountvsWorkload identity
Service account
the thing calling the API is not a person, and its permissions were granted once in 2022 by someone who has left.
An identity belonging to software rather than a human, used for automated access. They outnumber human accounts by a wide margin, they accumulate permissions because nothing prompts a review, and they rarely have an owner. Every serious cloud compromise story features one, which is why inventorying them and attaching an expiry or a review to each is worth the tedium.
Full entry →Workload identity
the service proves what it is to the cloud without holding any credential, because the platform attests to it.
Giving a running workload a cryptographic identity derived from where and what it is, which other systems can verify, instead of a shared secret it must carry. It is what eliminates long-lived keys in application configuration and what makes mutual TLS between services possible without a certificate distribution problem. It also makes authorisation legible, since policies name the service rather than an opaque key.
Full entry →