Application identity.
WHAT A SERVICE ACCOUNT PROVIDES
An identity an application uses to authenticate.
HOW APPLICATIONS SHOULD AUTHENTICATE
By using an identity attached to the resource they run on.
WHY THAT MATTERS
No key exists, so no key can leak.
WHAT WORKLOAD IDENTITY FEDERATION PROVIDES
External systems authenticating using their own identity, without a key.
WHAT THAT SUITS
Pipelines and workloads running outside the platform.
WHAT SERVICE ACCOUNT KEYS ARE
Long-lived credential files.
WHAT THEY CAUSE
Credentials committed to repositories Credentials shared between people Credentials that are never rotated
WHY THAT IS SERIOUS
A leaked key grants everything that account can do, until someone notices.
WHAT TO DO IF ONE IS NEEDED ANYWAY
Restrict the account's permissions tightly Store the key in a secret manager Rotate it on a schedule Monitor its use
WHAT TO AUDIT
Which service accounts exist What permissions each holds Which have keys Which have not been used recently
WHAT TO DISABLE
Accounts nobody can account for.
