Replace a static key with a scoped workload identity

short · 55 min · Objective 2.3

Task

Convert one integration from a long-lived credential to a short-lived federated one, and prove the trust condition is narrow enough to matter.

Steps

  1. Identify one integration currently using a static key and record its age and scope in lab/static-credentials.csv as integration,credential_type,age_days,scope,owner.
  2. Configure federation so the workload authenticates with a short-lived token, with a trust condition naming the specific repository, branch, cluster or service account.
  3. Prove the scope: attempt to obtain a token from a DIFFERENT repository, branch or workload and capture the refusal in lab/federation-scope.txt.
  4. Delete the static key and confirm the integration still works.
  5. Sweep for every other long-lived credential in the lab and add each to lab/static-credentials.csv with a planned replacement date.

Verify

awk -F, 'NR>1 {n++} END {print n" long-lived credential(s) found"}' lab/static-credentials.csv
grep -Eic 'denied|not authorized|subject|condition|mismatch' lab/federation-scope.txt
awk -F, 'NR>1 && $2=="static" {n++} END {print n+0" still static"}' lab/static-credentials.csv

A captured refusal from the WRONG workload -- which is what proves the condition is narrow -- and a sweep listing the rest. A trust condition that accepts any workload from an issuer accepts an attacker's workload too.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.