jargon

Comparison

Service accountvsWorkload identity

Service account

the thing calling the API is not a person, and its permissions were granted once in 2022 by someone who has left.

An identity belonging to software rather than a human, used for automated access. They outnumber human accounts by a wide margin, they accumulate permissions because nothing prompts a review, and they rarely have an owner. Every serious cloud compromise story features one, which is why inventorying them and attaching an expiry or a review to each is worth the tedium.

Full entry →

Workload identity

the service proves what it is to the cloud without holding any credential, because the platform attests to it.

Giving a running workload a cryptographic identity derived from where and what it is, which other systems can verify, instead of a shared secret it must carry. It is what eliminates long-lived keys in application configuration and what makes mutual TLS between services possible without a certificate distribution problem. It also makes authorisation legible, since policies name the service rather than an opaque key.

Full entry →

Related comparisons