auditing-machine-identity-issuance

Auditing machine identity issuance: the identity is only as trustworthy as the proof that earned it

Every machine identity, a service mesh certificate, a federated cloud credential, a signed workload token, is a statement the platform makes on a workload's behalf: this is who this thing is. Downstream services trust that statement and skip re-checking, which is the point of an identity system, so the entire chain of trust rests on one decision made at issuance: what proof did the platform require before it minted the identity. If that proof is weak or forgeable, the identity is legitimate and the holder is not. A certificate issued on a self-asserted name, an unvalidated label, or a reachable metadata endpoint lets an attacker who forges the proof obtain a real, trusted identity. An issuing authority whose scope is not constrained can mint identities for names it should never speak for, so a compromise of one issuer forges any workload. A workload-identity federation trust configured too broadly, a wildcard subject, an unpinned issuer, a missing audience, lets an outside principal assume a workload identity that was meant for a specific one. A certificate or token with an over-long lifetime or no revocation lets a compromised identity persist long after it should be dead. And an issuance path with no binding to a verified workload hands an identity to any caller who asks. The audit follows issuance from the proof presented to the identity granted, and checks that the proof is strong, the issuer is scoped, the federation trust is narrow, and the identity is short-lived and revocable. You audit this by presenting a weak or forged proof and seeing whether a legitimate identity comes back.

When to use

• A platform issues machine or workload identities: mesh certificates, workload-identity federation credentials, signed workload tokens, or attestation-based credentials.
• Issuance may rely on a weak or forgeable proof, or the issuing authority may not be scoped to the names it may speak for.
• A federation trust may be over-broad (wildcard subject, unpinned issuer, missing audience), or issued identities may be over-long-lived or unrevocable.