# Client Workload Identifiers overview > This page provides a high-level description of Client Workload Identifiers in Aembit. Client Workload identification is an initial step to recognize the specific software application, script, or automated process that initiates an access request to a Server Workload. This identification is critical because it’s a prerequisite for matching the request to the correct Access Policy and invoking the appropriate Trust Provider for identity attestation. Accurate identification is essential for enforcing the principle of least privilege and preventing misidentification which could lead to security vulnerabilities. Aembit addresses the need for accurate identification across diverse and heterogeneous environments by offering a variety of methods tailored to different deployment contexts. These methods leverage native identity constructs and environmental evidence available in those platforms. Examples of Aembit Client Workload identification methods include: * **Kubernetes** - Using the Pod Name Prefix, the exact Pod Name, or the Kubernetes Service Account under which the container runs. * **Cloud Platforms (AWS, Azure)** - Using Instance Metadata Attributes (like instance ID or tags), AWS IAM Role ARN, Azure Subscription ID, or Azure VM ID. * **CI/CD Systems (GitHub Actions, GitLab Jobs)** - Inspecting claims within ephemeral OpenID Connect (OIDC) tokens, such as repository name, subject, namespace path, or project path. * **Serverless Platforms (AWS Lambda)** - Using the unique AWS Lambda Function ARN. * **Virtual Machines (VMs)** - Identifying by Hostname, Process Name, or both. * **MCP Clients** - Using the redirect URI from Dynamic Client Registration, or the URL of a Client ID Metadata Document (CIMD), to identify MCP clients connecting through the MCP Authorization Server. * **Aembit Native** - A unique Aembit Client ID that Aembit assigns for scenarios where other identifiers won’t work. Aembit supports [configuring multiple identifiers](/user-guide/access-policies/client-workloads/identification/client-workload-multiple-ids) for a single Client Workload definition, to increase its uniqueness when identifying your Client Workloads. ## Available Client Workload identification methods Aembit supports a variety of identification methods for Client Workloads, allowing you to choose the most suitable one based on your deployment environment and requirements. Each method provides a unique way to identify workloads, making sure that Aembit applies your Policies accurately. These methods include identifiers based on cloud provider resources, Kubernetes configurations, and more. The choice of identifier can depend on the specific characteristics of your workloads and the environments in which they operate. The following sections are the different identification methods available: ### Generic Client Workload Identifiers ![Aembit Icon](/aembit-icons/aembit-icon-color.svg) [Aembit Client ID](/user-guide/access-policies/client-workloads/identification/aembit-client-id)Identify workloads by their Aembit Client ID. → ![Computer Icon](/aembit-icons/client-workload.svg) [Hostname](/user-guide/access-policies/client-workloads/identification/hostname)Identify workloads by their hostname. → ![Gear With Code Icon](/aembit-icons/gear-complex-code-light.svg) [Process Name](/user-guide/access-policies/client-workloads/identification/process-name)Identify workloads by their process name. → ![Gear With Code Icon](/aembit-icons/gear-complex-code-light.svg) [Process Command Line](/user-guide/access-policies/client-workloads/identification/process-command-line)Identify workloads by their process command line. → ![Gear With Code Icon](/aembit-icons/gear-complex-code-light.svg) [Process Path](/user-guide/access-policies/client-workloads/identification/process-path)Identify workloads by their executable path. → ![Gear With Code Icon](/aembit-icons/gear-complex-code-light.svg) [Process User Name](/user-guide/access-policies/client-workloads/identification/process-user-name)Identify workloads by their process user name. → ![Computer Icon](/aembit-icons/client-workload.svg) [Source IP Address](/user-guide/access-policies/client-workloads/identification/source-ip)Identify workloads by their source IP address. → ### AWS Client Workload Identifiers ![AWS Icon](/3p-logos/aws-icon.svg) [AWS Account ID](/user-guide/access-policies/client-workloads/identification/aws-account-id)Identify workloads by their AWS Account ID. → ![AWS EC2 Icon](/3p-logos/aws-ec2-icon.svg) [AWS EC2 Instance ID](/user-guide/access-policies/client-workloads/identification/aws-ec2-instance-id)Identify workloads by their AWS EC2 Instance ID. → ![AWS ECS Icon](/3p-logos/aws-ecs-icon.svg) [AWS ECS Task Family](/user-guide/access-policies/client-workloads/identification/aws-ecs-task-family)Identify workloads by their AWS ECS Task Family. → ![AWS ECS Icon](/3p-logos/aws-ecs-icon.svg) [AWS ECS Service Name](/user-guide/access-policies/client-workloads/identification/aws-ecs-service-name)Identify workloads by their AWS ECS Service Name. → ![AWS Lambda Icon](/3p-logos/aws-lambda-icon.svg) [AWS Lambda ARN](/user-guide/access-policies/client-workloads/identification/aws-lambda-arn)Identify workloads by their AWS Lambda ARN. → ![AWS Region Icon](/3p-logos/aws-icon.svg) [AWS Region](/user-guide/access-policies/client-workloads/identification/aws-region)Identify workloads by their AWS Region. → ### Azure Client Workload Identifiers ![Azure Icon](/3p-logos/azure-icon2.svg) [Azure Subscription ID](/user-guide/access-policies/client-workloads/identification/azure-subscription-id)Identify workloads by their Azure Subscription ID. → ![Azure Icon](/3p-logos/azure-icon2.svg) [Azure VM ID](/user-guide/access-policies/client-workloads/identification/azure-vm-id)Identify workloads by their Azure VM ID. → ### GCP Client Workload Identifiers ![GCP Icon](/3p-logos/gcp-icon.svg) [GCP Identity Token](/user-guide/access-policies/client-workloads/identification/gcp-identity-token)Identify workloads by their GCP Identity Token email. → ### GitHub Client Workload Identifiers ![GitHub Icon](/3p-logos/github-icon.svg) [GitHub ID Token Repository](/user-guide/access-policies/client-workloads/identification/github-id-token-repository)Identify workloads by their GitHub ID Token Repository. → ![GitHub Icon](/3p-logos/github-icon.svg) [GitHub ID Token Subject](/user-guide/access-policies/client-workloads/identification/github-id-token-subject)Identify workloads by their GitHub ID Token Subject. → ### GitLab Client Workload Identifiers ![GitLab Icon](/3p-logos/gitlab-icon.svg) [GitLab ID Token Namespace Path](/user-guide/access-policies/client-workloads/identification/gitlab-id-token-namespace-path)Identify workloads by their GitLab ID Token Namespace Path. → ![GitLab Icon](/3p-logos/gitlab-icon.svg) [GitLab ID Token Project Path](/user-guide/access-policies/client-workloads/identification/gitlab-id-token-project-path)Identify workloads by their GitLab ID Token Project Path. → ![GitLab Icon](/3p-logos/gitlab-icon.svg) [GitLab ID Token Ref Path](/user-guide/access-policies/client-workloads/identification/gitlab-id-token-ref-path)Identify workloads by their GitLab ID Token Ref Path. → ![GitLab Icon](/3p-logos/gitlab-icon.svg) [GitLab ID Token Subject](/user-guide/access-policies/client-workloads/identification/gitlab-id-token-subject)Identify workloads by their GitLab ID Token Subject. → ### Kubernetes Client Workload Identifiers ![Kubernetes Icon](/3p-logos/kubernetes-icon.svg) [Kubernetes Namespace](/user-guide/access-policies/client-workloads/identification/kubernetes-namespace)Identify workloads by their Kubernetes Namespace. → ![Kubernetes Icon](/3p-logos/kubernetes-icon.svg) [Kubernetes Pod Name Prefix](/user-guide/access-policies/client-workloads/identification/kubernetes-pod-name-prefix)Identify workloads by their Kubernetes Pod Name Prefix. → ![Kubernetes Icon](/3p-logos/kubernetes-icon.svg) [Kubernetes Pod Name](/user-guide/access-policies/client-workloads/identification/kubernetes-pod-name)Identify workloads by their Kubernetes Pod Name. → ![Kubernetes Icon](/3p-logos/kubernetes-icon.svg) [Kubernetes Service Account Name](/user-guide/access-policies/client-workloads/identification/kubernetes-service-account-name)Identify workloads by their Kubernetes Service Account Name. → ![Kubernetes Icon](/3p-logos/kubernetes-icon.svg) [Kubernetes Service Account UID](/user-guide/access-policies/client-workloads/identification/kubernetes-service-account-name)Identify workloads by their Kubernetes Service Account UID. → ### OIDC Client Workload Identifiers ![JWT Icon](/3p-logos/jwt-icon.svg) [OIDC ID Token](/user-guide/access-policies/client-workloads/identification/oidc-id-token)Identify workloads by a custom claim in an OIDC ID token. → ![JWT Icon](/3p-logos/jwt-icon.svg) [OIDC ID Token Audience](/user-guide/access-policies/client-workloads/identification/oidc-id-token-audience)Identify workloads by the audience claim in an OIDC ID token. → ![JWT Icon](/3p-logos/jwt-icon.svg) [OIDC ID Token Issuer](/user-guide/access-policies/client-workloads/identification/oidc-id-token-issuer)Identify workloads by the issuer claim in an OIDC ID token. → ![JWT Icon](/3p-logos/jwt-icon.svg) [OIDC ID Token Subject](/user-guide/access-policies/client-workloads/identification/oidc-id-token-subject)Identify workloads by the subject claim in an OIDC ID token. → ### Terraform Cloud ![Terraform Icon](/3p-logos/terraform-icon.svg) [Terraform Cloud ID Token Organization ID](/user-guide/access-policies/client-workloads/identification/terraform-cloud-id-token-organization-id)Identify workloads by Terraform Cloud ID Token Organization ID. → ![Terraform Icon](/3p-logos/terraform-icon.svg) [Terraform Cloud ID Token Project ID](/user-guide/access-policies/client-workloads/identification/terraform-cloud-id-token-project-id)Identify workloads by Terraform Cloud ID Token Project ID. → ![Terraform Icon](/3p-logos/terraform-icon.svg) [Terraform Cloud ID Token Workspace ID](/user-guide/access-policies/client-workloads/identification/terraform-cloud-id-token-workspace-id)Identify workloads by Terraform Cloud ID Token Workspace ID. → ### MCP Client Workload Identifiers ![Client Workload Icon](/aembit-icons/client-workload.svg) [Redirect URI](/user-guide/access-policies/client-workloads/identification/redirect-uri)Identify MCP clients by their OAuth redirect URI. → ![Client Workload Icon](/aembit-icons/client-workload.svg) [CIMD Client ID](/user-guide/access-policies/client-workloads/identification/cimd-client-id)Identify MCP clients by the URL of their Client ID Metadata Document. →