Workload Identity
also called Service Identity, Federated Identity
Giving a running workload a cryptographically verifiable identity issued by the platform, so it obtains short-lived credentials without a stored secret.
The alternative it replaces is a long-lived access key placed in configuration or an environment variable — which is present in the image, the deployment manifest, the CI system and several engineers' laptops, cannot be rotated without a coordinated change, and does not expire.
Workload identity inverts this. The platform attests to what the workload is — this pod, this service account, this instance, this repository — and the identity provider exchanges that attestation for short-lived credentials. There is no secret to leak, and credentials expire in minutes.
Implementations across contexts: instance roles and IRSA on AWS, managed identities on Azure, workload identity federation on GCP, SPIFFE/SPIRE as the platform-neutral standard, and OIDC federation from CI providers such as GitHub Actions — which removes the last common reason to store cloud keys anywhere.
Two design points. Identity should be as narrow as the workload, not shared across a cluster or an account, or a compromise of any workload yields the identity of all of them. And this is the prerequisite for zero trust: per-request authorisation is meaningless without a trustworthy per-workload identity to authorise.