Workload Identity Resource Principle

A computing system comprising:

• one or more processors;
• and
• one or more computer-readable media having stored thereon a sequence of instructions, when executed, cause the one or more processors to:
• receive, by a manager instance of the computing system, a first request for a first token to access a computing resource, the first request from a computing process of a plurality of computing processes associated with a service account,
• determine, by the manager instance of the computing system, an identity of the service account based at least in part on an authentication;
• generate, by the manager instance of the computing system, a second request for the first token based at least in part on the authentication;
• transmit, by the manager instance of the computing system, the second request to a token issuance service of the computing system, the second request comprising a manager instance signature and the identity of the service account;
• generate, by the token issuance service of the computing system, a third request for the first token, the third request comprising the identity of the service account and a token issuance service signature;
• transmit, by the token issuance service of the computing system, the third request to an identity service of the computing system;
• determine, by the identity service of the computing system, whether to generate the first token based at least in part on the identity of the service account, a policy associated with the service account;
• and
• generate, by the identity service of the computing system, the first token based at least in part on determining whether to generate the first token.

One or more non-transitory computer-readable media having stored thereon a sequence of instructions that, when executed by one or more processors of a computing system, cause the computing system to:

• receive, by a manager instance of the computing system, a first request for a first token to access a computing resource, the first request from a computing process of a plurality of computing processes associated with a service account,
• determine, by the manager instance of the computing system, an identity of the service account based at least in part on an authentication;
• generate, by the manager instance of the computing system, a second request for the first token based at least in part on the authentication;
• transmit, by the manager instance of the computing system, the second request to a token issuance service of the computing system, the second request comprising a manager instance signature and the identity of the service account;
• generate, by the token issuance service of the computing system, a third request for the first token, the third request comprising the identity of the service account and a token issuance service signature;
• transmit, by the token issuance service of the computing system, the third request to an identity service of the computing system;
• determine, by the identity service of the computing system, whether to generate the first token based at least in part on the identity of the service account, a policy associated with the service account;
• and
• generate, by the identity service of the computing system, the first token based at least in part on determining whether to generate the first token.