Skip to content
ReleasesGitHub

How to add a Trust Provider

Trust Provider: Trust Providers validate Client Workload identities through workload attestation, verifying identity claims from the workload's runtime environment rather than relying on pre-shared secrets.Learn more enable Aembit to authenticate without provisioning credentials or other secrets. Trust Providers are third-party systems or services that can attest identities with identity documents, tokens, or other cryptographically signed evidence.

Client Workload: Client Workloads represent software applications, scripts, or automated processes that initiate access requests to Server Workloads, operating autonomously without direct user interaction.Learn more identity attestation ensures that only trusted Client Workloads can reach the Server Workload: Server Workloads represent target services, APIs, databases, or applications that receive and respond to access requests from Client Workloads.Learn more that Aembit protects.

Configure Trust Provider

Section titled “Configure Trust Provider”

If you are getting started with Aembit, configuring Trust Providers is optional; however, it’s critical to secure all production deployments.

  1. Click the Trust Providers tab.

  2. Click + New to create a new Trust Provider.

  3. Give the Trust Provider a name and optional description.

  4. Choose the appropriate Trust Provider type based on your Client Workloads’ environment.

  5. Follow the instructions for the Trust Provider based on your selection. Select your Trust Provider type from the sidebar to open its configuration details.

  6. Configure one or more match rules (specific to your Trust Provider type).

  7. Click Save.

Client Workload identity attestation

Section titled “Client Workload identity attestation”

You must associate one or more Trust Providers with the existing Access Policy: Access Policies define, enforce, and audit access between Client and Server Workloads by cryptographically verifying workload identity and contextual factors rather than relying on static secrets.Learn more for Aembit to use Client Workload identity attestation.

  1. Select an existing Access Policy to open the Access Policy Builder.

  2. In the Trust Provider card in the right panel, click + Configure.

  3. Select the Add New tab to create a new Trust Provider, or select the Select Existing tab to choose from existing Trust Providers.

    Associate Trust Provider to Policy

Agent Controller identity attestation

Section titled “Agent Controller identity attestation”

You must associate a Trust Provider with Agent Controller in order for Aembit to use Agent Controller for identity attestation.

  1. Click the Edge Components tab.

  2. Select one of the existing Agent Controllers.

  3. Click Edit.

  4. From the dropdown, choose one of the existing Trust Providers.

    Agent Controller Trust Provider Page