Identity & access
What is Workload Identity Federation?
Also known as: WIF · 워크로드 신원 · 워크로드 아이덴티티 페더레이션
Workload identity federation lets a workload in one environment, such as GitHub Actions, exchange a trusted identity assertion for access in another, such as AWS or Google Cloud. When configured for the workload, it can replace a stored long-lived cloud key; the trust policy and resulting permissions still need review.
More terms in Identity & access
- Non-Human IdentityA digital identity used by software or a workload to authenticate without a person signing in for each request. Examples include service accounts and workload identities; API keys and tokens are credentials these identities may use. Check who owns the identity, which resources it can access, and how its credentials expire or are revoked.
- IAMThe discipline of managing digital identities (human and non-human) and controlling what each identity can do. In cloud context (AWS IAM, GCP IAM), it refers specifically to the policy and role systems that govern resource access.
- Least PrivilegeLeast privilege means granting an identity only the actions and resources its task requires, then reviewing that access as the task changes. For example, a batch job that reads one bucket should not receive broad administrator permissions.
- Zero TrustAn architectural pattern that treats every request as untrusted by default, regardless of network location, and verifies identity and authorization on every call. For NHIs, this means continuous verification instead of "once issued, always trusted."
- Service AccountA service account is an account used by an application, script or workload to authenticate to another service. Its permissions, owner, credential lifetime and usage logs need review just like those of a human account.
- PAMSystems and processes that control, monitor, and audit privileged human access to critical systems. PAM does not generally cover NHIs; machine identities need their own lifecycle tooling, which is where Cremit Platform focuses.