Client Workload Identifiers overview

Client Workload identification is an initial step to recognize the specific software application, script, or automated process that initiates an access request to a Server Workload. This identification is critical because it’s a prerequisite for matching the request to the correct Access Policy and invoking the appropriate Trust Provider for identity attestation. Accurate identification is essential for enforcing the principle of least privilege and preventing misidentification which could lead to security vulnerabilities.

Aembit addresses the need for accurate identification across diverse and heterogeneous environments by offering a variety of methods tailored to different deployment contexts. These methods leverage native identity constructs and environmental evidence available in those platforms.

Examples of Aembit Client Workload identification methods include:

Kubernetes - Using the Pod Name Prefix, the exact Pod Name, or the Kubernetes Service Account under which the container runs.
Cloud Platforms (AWS, Azure) - Using Instance Metadata Attributes (like instance ID or tags), AWS IAM Role ARN, Azure Subscription ID, or Azure VM ID.
CI/CD Systems (GitHub Actions, GitLab Jobs) - Inspecting claims within ephemeral OpenID Connect (OIDC) tokens, such as repository name, subject, namespace path, or project path.
Serverless Platforms (AWS Lambda) - Using the unique AWS Lambda Function ARN.
Virtual Machines (VMs) - Identifying by Hostname, Process Name, or both.
Aembit Native - A unique Aembit Client ID that Aembit assigns for scenarios where other identifiers won’t work.

Aembit supports configuring multiple identifiers for a single Client Workload definition, to increase its uniqueness when identifying your Client Workloads.

Available Client Workload identification methods

Aembit supports a variety of identification methods for Client Workloads, allowing you to choose the most suitable one based on your deployment environment and requirements. Each method provides a unique way to identify workloads, making sure that Aembit applies your Policies accurately.

These methods include identifiers based on cloud provider resources, Kubernetes configurations, and more. The choice of identifier can depend on the specific characteristics of your workloads and the environments in which they operate.

The following sections are the different identification methods available: