So, How Do Service Accounts Actually Work?
summary
Shows how cloud service accounts provide credentials: Google and AWS SDKs probe for credential sources, call the VM/Kubernetes metadata endpoint (169.254.169.254) to exchange metadata for short‑lived tokens, and then add an Authorization header. Demonstrations use gcloud, gsutil, curl, jq and the Google Java SDK to fetch a token and list Storage buckets, and the same flow is shown on a VM and via Kubernetes metadata proxies (Workload Identity / IAM Roles for Service Accounts); the talk notes this is convenient but increases attack surface if privileges or metadata access aren’t restricted.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:03What is the Cloud
- 3:53Human authentication
- 10:53Service accounts for apps
- 17:04Demo on VM
- 22:52Service accounts and Kubernetes
- 28:58Summary and limits
related talks
34mThrow Away Your Passwords: Trusting Workload Identity
30mThe GCP Metadata API
22mHow to Secure Cloud Machine Identities
33mService Account: With Great Powers Come Great Responsibilities
28m"PIVOT!" — Bouncing between your app, your cluster and your cloud
05mLightning Talk: Don’t Make Me Impersonate My Identity
33mSecuring Kubernetes in the Cloud
25mCan you keep a secret?