IAM Concepts

Identity and Access Management (IAM) concepts cover the policies, processes, and tools used to manage digital identities and regulate user access to resources. Key IAM principles include authentication, authorization, provisioning, and least privilege. Effective IAM ensures that the right users have the right access at the right time.

Categories:

JSON Web Token (JWT)

IAM Concepts

A JWT transmits identity and authorization claims as a cryptographically signed JSON object for stateless workload authentication.

Single Sign-On (SSO)

IAM Concepts

SSO lets users authenticate once and access multiple applications, but its browser-based flows stop short of workload authentication.

Selector

IAM Concepts

In SPIFFE and SPIRE, a selector is an attribute used to identify and attest a workload or node, such as a Kubernetes namespace, service account name, Docker image hash, or Unix process UID. Selectors are the rules SPIRE uses to determine which SPIFFE ID a workload should receive. Getting selector definitions right is a key part of implementing least-privilege workload identity: too broad a selector grants identity to more workloads than intended, expanding the blast radius of any compromise.

Node Attestation

IAM Concepts

Node attestation is the process by which a SPIRE server verifies the identity and integrity of a node (physical machine, VM, or Kubernetes node) before allowing the SPIRE agent running on it to request SVIDs for workloads. It uses platform-specific mechanisms such as cloud provider instance identity documents or TPM measurements to establish trust in the underlying infrastructure before any workload identity is issued on top of it.

Workload Attestation

IAM Concepts

Workload attestation is the process by which a SPIRE agent verifies that a requesting process is actually the workload it claims to be before issuing a SVID. Attestation uses platform-specific evidence such as Kubernetes pod labels, AWS instance metadata, or process attributes to confirm workload authenticity at runtime. It is the mechanism that replaces static pre-shared secrets with dynamic, context-verified identity, and it is fundamental to how SPIFFE-based systems eliminate credential bootstrapping problems.

SPIFFE Federation

IAM Concepts

SPIFFE federation is the mechanism that allows workloads in separate trust domains to authenticate each other by exchanging and trusting each other’s trust bundles. It enables secure service-to-service communication across organizational, cloud, or team boundaries without requiring shared secrets or a single centralized identity authority. Federation is how SPIFFE scales from a single cluster deployment to a multi-cloud, multi-partner workload identity architecture.

Trust Bundle

IAM Concepts

A trust bundle is the set of root certificates that a workload uses to verify the SVIDs issued by a given SPIFFE trust domain. It is the cryptographic foundation for cross-workload authentication: before a service accepts a peer’s identity, it validates the peer’s SVID against the relevant trust bundle. Managing trust bundles carefully is essential in federated environments where multiple SPIRE deployments need to recognize each other’s workload identities.

Trust Domain

IAM Concepts

A trust domain is the administrative boundary within which a SPIFFE identity authority operates and its issued SVIDs are considered valid. Workloads within the same trust domain share a common root of trust, while cross-domain access requires explicit trust federation. In multi-cloud and multi-team environments, trust domains let organizations segment workload identity authority while still enabling controlled, policy-governed access across boundaries without static credentials.

SPIFFE ID

IAM Concepts

A SPIFFE ID is a structured URI that uniquely identifies a workload within a SPIFFE-based system, following the format spiffe://trust-domain/workload-path. It serves as the stable identity anchor for a workload regardless of where it is running, what IP address it has, or what cluster it belongs to. SPIFFE IDs are embedded in SVIDs and used by relying services to make access decisions based on workload identity rather than network location.

SVID (SPIFFE Verifiable Identity Document)

IAM Concepts

An SVID is the cryptographic credential defined by the SPIFFE standard that represents a workload’s identity. It takes the form of an X.509 certificate or a JWT, both containing a SPIFFE ID that uniquely identifies the workload. SVIDs are short-lived, automatically rotated, and verifiable without shared secrets, making them the core building block of secretless authentication in SPIFFE-based workload identity systems.