Feature Store  ·  View 20 of 21  ·  Assurance

Identity and Access

A human proves purpose; a workload proves identity. Neither gets a shared key.

Editable source SVG draw.io All views
Data scientist Corporate IdP Registry API Lake Formation Offline store Model pod Serving API 1. OIDC authenticate 2. id token + group claims 3. offline read: 3 feature groups 4. group ACL + declared purpose 5. request scoped credential 6. column and row grants 7. as-of rows, permitted columns 8. group 3: purpose not granted 9. gRPC + IRSA workload identity 10. role → authorised group set 11. vector, authorised groups only 12. PERMISSION_DENIED on group 5 Identity and Access — Offline Read and Online Read A human proves purpose; a workload proves identity. Neither gets a shared key, and both are refused at group granularity. v 1.0 · owner Data Platform Architecture · date 2026-09

Decisions

  • No shared API keys for service-to-service reads. Every caller is a workload identity, and authorisation is evaluated per feature group.
  • A human's offline read is authorised on group ACL plus declared purpose, and the credential Lake Formation issues is scoped to the columns that survive both checks.
  • A denied group is refused explicitly and by name, not silently dropped from the vector — a silently narrower vector is a silent accuracy change.

Assumptions

  • IRSA for workload identity on EKS; corporate OIDC for people; grants expire and must be renewed.

Risks

  • Group-granularity authorisation means a consumer authorised for a group is authorised for every feature in it. Splitting a group is the only way to narrow that, which pushes access control into the data model.
◀  Security Trust Zones All views Failure Classes  ▶
Solution Architecture v1.0 · Amazon Web Services · Data Platform Architecture · 2026-09 · 21 views · 14 architecture decision records20-identity-and-access