Proving workload identity at Lumen Pay, a multi-cloud payments platform with 4,000 services and CI runners in three systems: the incident path where a CI job's long-lived cloud key was printed in a public build log and used to read the production payments database, replaced by an OIDC identity exchanged for a 15-minute, audience-bound token on one least-privilege role; and the eight-tile identity board — threat model, issuance and trust roots, federation across AWS, GCP, Azure and CI, credential lifetime and revocation, least privilege replacing a wildcard role shared by 14 services, secrets versus identity, verification and attestation, and observability.

CY-EXPERT-025Expert Level · Cloud Native Security

Workload Identity Architecture Assurance — The Identity Board

An expert-level course that architects and proves strong workload identity across clouds, clusters, and CI — replacing static credentials with short-lived, attested identity bound to least-privilege authorisation, working the eight-tile Identity Board (Threat Model & Principles, Issuance & Trust Roots, Federation Across Clouds/Clusters/CI, Credential Lifetime & Revocation, Authorisation Binding & Least Privilege, Secrets vs Identity, Verification & Attestation, Observability & Metrics) with real SPIRE/SPIFFE, Kubernetes projected tokens, cloud workload identity federation, OIDC token exchange, key rotation, wildcard scans, secretless database credentials, mTLS/attestation checks, and identity-aware log and metrics work.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Model workload identity threats (static credential theft, confused deputy, token replay, wildcard access, CI as perimeter) and state the five principles that guide the program.
Issue short-lived, attested workload identities from a defined trust root using SPIFFE/SPIRE, bound Kubernetes tokens, and cloud-native workload identity.
Federate trust across clouds, clusters, and CI via OIDC and token exchange without creating transitive over-trust.
Bind every identity to fine-grained, least-privilege authorisation, eliminate static credentials, attest workloads at runtime, and prove program progress with auditable metrics.

Price:৳12,000