IAM Concepts

A system, application, or service that relies on an identity provider for authentication and authorization. Service providers accept identity tokens or assertions from the IdP to grant access to their resources or functionalities.

STS (such as AWS Security Token Service) is a cloud service that provides temporary, limited-privilege credentials for authenticated users or workloads. These tokens allow access to resources for a specific duration, reducing the need for long-term credentials and improving security.

SPIFFE is an open-source standard that defines how workloads in dynamic, distributed environments prove their identity without relying on static secrets or network location. It specifies a universal identity format called a SVID and a set of APIs for issuing and validating those identities. For teams building secretless workload access, SPIFFE provides the identity foundation that makes cryptographic attestation practical at scale.

SPIRE is the production-grade, open-source implementation of the SPIFFE specification. It handles the full lifecycle of workload identity: attesting workload authenticity, issuing SVIDs, rotating credentials automatically, and federating trust across environments. Where SPIFFE defines the standard, SPIRE does the operational work. Organizations use SPIRE as the identity infrastructure layer that enables secretless, policy-driven workload access across Kubernetes, VMs, and multi-cloud environments.