Credentials and Secrets: Prefer Short-Lived Workload Identity
Short-lived workload identity replaces static cloud access keys, so leaked credentials expire quickly and stay scoped to one workload. This interactive lesson redesigns storefront credentials and keeps third-party tokens in a secrets manager. Covers: IAM roles, Azure managed identities, Google Cloud service accounts, user-managed key risks, runtime secret retrieval, rotation, audit logs, asset inventory. Prerequisites: Cloud IAM and authorization basics.
We'll cover the following...
A repository README that says, “Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the container environment variables” describes a persistent credential distribution path. We should replace it with workload identity, an identity assigned to running compute so it can obtain temporary credentials without embedding a reusable cloud key in the application or deployment configuration. A leaked ...