---
title: "Give services the identity of their · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/workload-identity
updated: 2026-10-20
licence: "All rights reserved"
---

# Give services the identity of their machine

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Configuration and secrets](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets)
- Rule: Let each running service get cloud credentials from the platform's identity, such as an instance role, a Kubernetes service account or a managed identity. Put no cloud key in its settings.
- How: Attach a role to the server, container task or function. The cloud SDK's default credential chain finds it without any code. Give each service its own role. Outside a cloud, use workload identity federation where the platform offers it, before reaching for a key file.
- Check: The running service's environment holds no `AWS_SECRET_ACCESS_KEY`, and no `GOOGLE_APPLICATION_CREDENTIALS` that points to a key file. Its calls appear in the audit log under its role.

Example:

```ts
// The SDK finds the role attached to the machine. No key in code or settings.
import { S3Client, GetObjectCommand } from '@aws-sdk/client-s3';

const s3 = new S3Client({});
const invoice = await s3.send(new GetObjectCommand({ Bucket: 'example-shop-invoices', Key: 'A-1042.pdf' }));
```

```python
import boto3

s3 = boto3.client("s3")
invoice = s3.get_object(Bucket="example-shop-invoices", Key="A-1042.pdf")
```

```sh
# Fails when a service carries a static cloud key
! tr '\0' '\n' < "/proc/$(systemctl show -p MainPID --value shop)/environ" | grep -E '^AWS_SECRET_ACCESS_KEY='
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/workload-identity`.

- Previous: [Let CI sign in with OIDC](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/oidc-for-ci)
- Next: [Rotate secrets automatically](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/automatic-secret-rotation)
- [Configuration and secrets](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets)