Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python
summary
Concrete implementation of Identity-Per-Transaction: a Python identity broker (open source as mayfly) that builds inline IAM policies and calls AWS STS to issue per-file credentials (one S3 object ARN) that expire within a 900s max, with warm STS latency ~120ms and end-to-end measured overhead ≈0.1% for 500 MB transforms. Streaming de‑identification uses generators plus Microsoft Presidio with a 0.95 confidence cutoff (false negatives <2%) and quarantines low‑confidence records. Audit trail emits immutable JSON entries with a SHA‑256 canary and ships to S3 object‑lock WORM storage; validated for FedRAMP High and heavily parallelized.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:11Service account credentials problem
- 2:57Identity per transaction
- 4:00Architecture overview
- 5:26Identity broker code demo
- 7:10Identity broker internals
- 9:56Security guarantees
- 10:18Performance impact
- 12:03Data processing in transit
- 14:53Audit logging
- 17:21Ephemeral compute benefits
- 19:08Key takeaways
- 20:56Q&A
related talks
17mThe Disposable Identity: Eliminating Non-Human Identity Risk in Federal Healthcare...
26mZero Trust: Continuous Verification in the Modern Enterprise
49mZero Trust Security
41mJourneys to Zero Trust on AWS
50mIdentity & Trust in Monitored Spaces
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords
34mZero trust CI/CD pipeline
20mZero-Trust Security Strategy in Serverless App Deployment