Service account
A non-human identity used by a workload or automation, such as a Kubernetes ServiceAccount or a cloud service account. Bind each one to one workload, prefer short-lived federated credentials to exported keys, and grant only the permissions that workload needs.
- Defined in
- Kubernetes: Service accounts
Covered in
Run Kubernetes workloads with only the privileges they need
Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.
Review cloud permissions and role trust together
Distinguish who can obtain a cloud identity from what that identity can do, then test the effective access path.
Case study: the Okta support-system breach and session tokens in HAR files (2023)
How a service account password saved to a personal browser profile let an attacker download customers' HAR files from Okta's support system, replay the session tokens inside them against five customers, and stay unseen for two weeks; and why HAR files are credentials, admin sessions need binding, and every exposed credential must be rotated.
Apply a security baseline across AWS, Azure and Google Cloud
Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.
Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS
How a running workload should get its credentials: encrypt Kubernetes Secrets with a KMS v2 provider and lock down RBAC, mount from an external store with the Secrets Store CSI Driver, sync with External Secrets Operator, issue dynamic credentials with Vault and its Agent Injector, keep Git copies encrypted with SOPS, and make rotation reach the process.
Detect container and host threats at runtime with eBPF sensors and cloud services
Watch process, file and network activity inside containers with an eBPF sensor or a managed cloud agent, write and test rules for the attacks you expect, tune them with narrow exceptions and contain a compromised pod without destroying evidence.
All 8 pages that cover Service account in the library
Practice: Privileged container lab: Reject a privileged workload before deployment · NetworkPolicy lab: Lock down a shop namespace · IAM trust policy lab: Evaluate a role trust policy against the confused deputy · Local project: Verify Kubernetes admission and network boundaries