Start here: identity for machines in the cloud

The earlier tracks were about people, like Maya and Priya. In the cloud, most identities are not people. They are machines: an app, a nightly build job, a service that talks to other services. Your goal: learn how a machine proves who it is without a password.

Three machines you already depend on

• A delivery robot in an apartment block. The gate must know it is the real robot, and not a stranger in a robot costume. The robot may open the lobby door. It may not open every flat.
• A payroll script that runs at midnight. Nobody is awake to type a password. It must still prove who it is to the bank system.
• A build pipeline that updates a website. It must publish new pages. It must not be able to read the customer list.

Each machine needs three things. A way to prove who it is. A pass that expires soon. A short list of things it may do. That is the whole track.

Why machines are different

A person can type a password and tap a phone prompt. A machine cannot. So for years teams pasted a long-lived secret into a config file. That secret is an access key or a database password. Then it leaked.

Here is the classic failure. A developer pushes the payroll script to a public code site, with the key inside. Bots scan those sites all day. Researchers have seen a leaked cloud key used within minutes.

The modern answer is different. A workload is a running app, job or service. It proves what it is with a signed credential that expires soon. No shared secret is needed. This builds on non-human identities and zero trust.

The journey

You will meet a cloud principal and a CI build job. You will meet services in a service mesh that talk over mutual TLS. The last lesson moves it all into a Kubernetes cluster.

1. Cloud identity 101 — the principals that are not people.
2. Workload identity federation — swap a stored secret for a signed identity.
3. SPIFFE, SVIDs & mTLS — a name for every service, one that can be checked.
4. Secrets management & rotation — keep the secrets that must exist safe.
5. Cross-account & cross-cloud trust — reach another account safely.
6. Least privilege for machines — only the power the job needs.
7. Kubernetes identity — pods that call the cloud with no stored key.
8. Cheat sheet & pop quiz — the whole track on one page.

How to use it

Take one lesson at a time. Your progress saves in your browser, and no account is needed. If you sign in, it syncs across your devices. Most lessons have a hands-on lab. The last lesson counts as read when you reveal all five answers.

The people are signed in. Now give the machines identities worth trusting. Start with Cloud identity 101.