Service Account: With Great Powers Come Great Responsibilities
summary
A platform feature for managing service accounts that creates, stores and rotates credentials, enforces automatic rotation and expiry notifications, and limits privileges per purpose. Authentication uses private-key JWT with the OAuth2 client_credentials flow, implemented using OpenSSL and jose to generate and sign tokens; end-to-end tests create per-role service accounts to verify API 403s and a branch-cleaner service account automates manual cleanup tasks.
AI-written summary · about
chapters (14)
- 0:00Service account intro
- 1:31Service vs user accounts
- 5:07Service account platforms
- 5:29Automation & security
- 9:22Escalation & spoofing threats
- 11:08Private Key JWT auth
- 17:31Secure credential storage
- 20:24Credential rotation plan
- 22:08Minimal permissions
- 24:16Account organization
- 25:21Security key questions
- 26:45Practical security example
- 29:16Conclusion
- 30:00Q&A
related talks
30mSo, How Do Service Accounts Actually Work?
34mThrow Away Your Passwords: Trusting Workload Identity
01h 06mMicroservice Authentication and Authorization
38mAuthentication as a Microservice: Portable Customer Identity Management
01h 10mPowerServer 2021: Integrating Third Party Authentication
13mService Authentication - Tokens or Certificates?
25mCan you keep a secret?
44mSecrets at Scale: Managing Cloud Credentials with PowerShell Automation