Audit Log Service  ·  View 36 of 40  ·  7 · Assurance

Identity and Credentials

How a workload proves who it is, and why the service records the identity it observed rather than the one it was told.

Editable source SVG draw.io All views
Producer Workload SPIRE Server Microsoft Entra ID Envoy Gateway Ingest API Custody Pod Managed HSM 1. attest node and workload selectors 2. SVID · TTL 1 h · no secret on disk 3. federated credential exchange 4. token · 60 min · aud audit-ingest 5. mTLS with SVID + bearer token 6. validate signature, audience, tenant claim 7. observed principal · scope = write 8. no read scope exists for this principal 9. managed identity custody-mi 10. sign checkpoint · role Crypto User 11. signature — key cannot be exported 12. key-use event, into this log Identity — Short-Lived Everywhere, No Shared Secret Anywhere The identity the service records on an event is the one it observed at message 7, never the one the payload claims. A producer that lies about its own actor field is contradicted by the record beside it, which is the point of recording both. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • No long-lived shared secret exists anywhere on the ingest path. Azure workloads use workload identity federation; non-Azure producers get a SPIFFE SVID from SPIRE with a one-hour TTL.
  • The identity written on an event is the one observed at the gateway, not the one asserted in the payload. Both are kept — a producer lying about its own actor field is precisely the event worth having.
  • Producer credentials carry a write scope and no read scope. There is no read scope that can be granted to a producer principal, so the misconfiguration is unavailable rather than merely forbidden.

Separation in practice

  • Five workload identities, one per plane, each with the narrowest Azure RBAC role that lets it do its job: create-only on the segment container for the sealer, read-only for the verifier, Crypto User on one key for the signer.
  • Human access is through Entra PIM with time-boxed elevation and approval; standing membership of the custody groups is empty.
  • Every HSM key use emits an event into this log, including the ones performed under break-glass.

Risks

  • SPIRE is another trust root to run, and its node attestation is the weakest link for off-Azure producers. Where possible, producers are onboarded through Entra federation instead and SPIRE is reserved for the on-premises estate.
◀  Trust Zones All views Roles and Separation of Duties  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source36-identity-and-credentials