Key where an identity would do

infoedge-auth-key-where-identity

The cloud behind this hop can authenticate the caller by an identity it never holds: a managed identity on Azure, an IAM role on AWS, a service account on Google Cloud. A key or a password has to be stored, rotated and kept out of logs, and a leaked one works from anywhere. Switch the edge's auth to the platform's identity.

Severity: info
Selects: every edge
Components in scope: 2,366

What it checks

It looks at every edge, and fires when:

— all of these hold:
— the edge's `auth` is one of "api-key" or "basic"
— the edge's target node:
— the node's component comes from azure, aws or gcp

Message

Edge '{{edge.from}}' -> '{{edge.to}}' authenticates with a key or a password to a cloud service that accepts an identity. Use managed-identity (Azure), iam-role (AWS) or service-account (Google Cloud).

{{node.id}} style paths are filled in from the node, the edge or the design the finding is about.

Applies to · 2,366 components

This rule is about an edge, so it belongs to a pair of nodes rather than one component.

This rule names no kind: it reads the design as a whole.

Tripped by · 1

Reference designs whose broken twin names this rule in its header. The gate reads the same header, and fails when a rule no design trips.

netflix-streamingreference

Source

1# yaml-language-server: $schema=../schema/rule.schema.json
2# A hop into an Azure, AWS or Google Cloud service authenticates with a key or a password, where
3# the platform offers an identity the caller never holds: a managed identity, an IAM role, a
4# service account. A key has to be stored, rotated and kept out of logs; an identity does not.
5# Tripped by: designs/reference/netflix-streaming/design.broken.yaml
6schemaVersion: "1"
7type: "rule"
8id: "edge-auth-key-where-identity"
9severity: "info"
10select:
11  edge: {}
12when:
13  all:
14    - field: "auth"
15      in: ["api-key", "basic"]
16    - to:
17        provider: ["azure", "aws", "gcp"]
18message: "Edge '{{edge.from}}' -> '{{edge.to}}' authenticates with a key or a password to a cloud service that accepts an identity. Use managed-identity (Azure), iam-role (AWS) or service-account (Google Cloud)."

The same page as markdown, for an agent: /catalogue/rules/edge-auth-key-where-identity.md