Aembit API

Aembit is a Workload Identity and Access Management (IAM) Platform for managing access between workloads—Workload IAM. The Aembit API enables Client Workloads, such as CI/CD tools, to authenticate and interact with Aembit without relying on long-lived secrets. Aembit achieves this secret-less authentication through workload attestation via a Trust Provider. By configuring Client Workloads with the appropriate trust and credential components, Aembit ensures secure, role-based access to your tenant’s API resources.

On this page you can find the Aembit configuration required to work with the Aembit service as a Server Workload using the REST API.

Prerequisites

Before proceeding with the configuration, make sure you have configured your Aembit Tenant.

For more detailed information on how to use the Aembit API, please refer to the official Aembit documentation. :::

Credential Provider configuration

1. Create a new Credential Provider.

   • Name - Choose a user-friendly name.
   • Credential Type - Aembit Access Token
   • Audience - Auto-generated by Aembit, this is a tenant specific server hostname used for authentication and connectivity with the Aembit API. Copy this value for use in the configuration that follows.
   • Role - Choose a role with the appropriate permissions that align with your Client Workload’s needs. Follow the principle of least privilege, assigning the minimum necessary permissions for the task. If needed, you can create new customer roles.
   • Lifetime - Specify the duration for which the generated access token remains valid.

Server Workload configuration

1. Create a new Server Workload.

• Name - Choose a user-friendly name.

2. Configure the service endpoint:

• Host - Enter the previously copied audience value.
• Application Protocol - HTTP
• Port - 443 with TLS
• Forward to Port - 443 with TLS
• Authentication method - HTTP Authentication
• Authentication scheme - Bearer

Access Policy

This page covers the Server Workload and Credential Provider configuration, which differs across Server Workload types. To complete the setup, create an Access Policy that lets a Client Workload access the Aembit Server Workload. Associate that policy with the Credential Provider, Trust Provider, and any optional Access Conditions.

Client Workload configuration

Aembit now handles the credentials required to access the Aembit API as a Server Workload, eliminating the need for you to manage them directly. You can remove any previously used credentials from the Client Workload.

Required features

• You must enable the TLS Decrypt feature if the Client Workload uses the Agent Proxy to access the Aembit API.