Identity Types

The practice of regulating access to resources or systems based on permissions and authorization policies. Secrets managers implement access control mechanisms to restrict who can view, modify, or retrieve stored secrets, ensuring that only authorized users or applications have access.

Categories:

Service Identity

Identity Types

A service identity uniquely identifies a workload so it can authenticate to other services, resources and APIs without human interaction.

Service Account

Identity Types

Service accounts give workloads programmatic access to resources, but static credentials and weak lifecycle management create risk.

JWT-SVID

Identity Types

A JWT-SVID is the token form of a SPIFFE Verifiable Identity Document, structured as a signed JSON Web Token containing the workload’s SPIFFE ID as the subject claim. Unlike X.509-SVIDs, JWT-SVIDs are better suited for HTTP-based service calls and API authentication, where presenting a certificate in a TLS handshake is not practical. They carry the same short-lived, automatically rotated properties as X.509-SVIDs and are validated by relying services using the issuing trust domain’s public keys.

X.509-SVID

Identity Types

An X.509-SVID is the certificate form of a SPIFFE Verifiable Identity Document, structured as a standard X.509 certificate with the workload’s SPIFFE ID embedded in the Subject Alternative Name (SAN) field. It enables mutual TLS (mTLS) between workloads, where both sides of a connection present and validate X.509-SVIDs to establish cryptographically verified, bidirectional identity. X.509-SVIDs are the most common SVID format used for long-lived service-to-service connections in SPIFFE environments.

Service Principal

Identity Types

A service principal is a non-human identity created for an application, automated workload, or script that needs to authenticate and access resources in a cloud environment. It acts as the machine equivalent of a user account, with its own credentials and permissions. In IAM for workloads, service principals are common vectors for credential sprawl and over-provisioning when not managed with dynamic, policy-driven access controls.

Machine Identity

Identity Types

Machine identity refers to cryptographic credentials (certificates, keys, tokens) that uniquely identify and authenticate nonhuman entities such as physical devices, software workloads, applications and services.

External Account

Identity Types

An external account is an identity that originates outside an organization’s primary identity domain. Instead of being provisioned and governed internally, it is issued by a third-party platform, cloud provider, CI/CD service, or SaaS environment.

Federated Identity

Identity Types

Federated identity allows users, machines, or workloads to authenticate once with a trusted identity provider and access resources across multiple domains or organizations without managing separate credentials for each.

Bot Identity

Identity Types

Unlike a human ID or a generic service account shared everywhere, bot identity ensures each automated actor is individually verified and granted scoped access permissions. This enables individual accountability for every automated action.

Identity Federation

Identity Types

Identity Federation is a security framework that enables users or workloads to authenticate once with an identity provider (IdP) and subsequently access multiple systems or service providers across different security domains without requiring separate credentials at each destination. Federation establishes cryptographic trust relationships between identity providers and relying parties through standardized protocols such as SAML 2.0, OAuth 2.0, and OpenID Connect, enabling secure sharing of authentication attributes and authorization decisions across organizational boundaries.