---
id: "edge-auth-key-where-identity"
type: "rule"
severity: "info"
url: "https://localhost:3000/catalogue/rules/edge-auth-key-where-identity"
---

# Key where an identity would do

An edge into an Azure, AWS or Google Cloud service authenticates with an API key or a password.

| | |
|---|---|
| Severity | info |
| Selects | every edge |
| Components in scope | 2,366 |

## Why

The cloud behind this hop can authenticate the caller by an identity it never holds: a managed identity on Azure, an IAM role on AWS, a service account on Google Cloud. A key or a password has to be stored, rotated and kept out of logs, and a leaked one works from anywhere. Switch the edge's auth to the platform's identity.

## What it checks

It looks at every edge, and fires when:

- all of these hold:
  - the edge's `auth` is one of "api-key" or "basic"
  - the edge's target node:
    - the node's component comes from azure, aws or gcp

Message template:

```
Edge '{{edge.from}}' -> '{{edge.to}}' authenticates with a key or a password to a cloud service that accepts an identity. Use managed-identity (Azure), iam-role (AWS) or service-account (Google Cloud).
```

## Applies to

This rule is about an edge, so it belongs to a pair of nodes rather than one component.

2,366 catalogue components fall under it.

## Tripped by

Reference designs whose broken twin names this rule in its header:

- [netflix-streaming](https://localhost:3000/d/zeema/netflix-streaming)

## Source (`rule` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../schema/rule.schema.json
# A hop into an Azure, AWS or Google Cloud service authenticates with a key or a password, where
# the platform offers an identity the caller never holds: a managed identity, an IAM role, a
# service account. A key has to be stored, rotated and kept out of logs; an identity does not.
# Tripped by: designs/reference/netflix-streaming/design.broken.yaml
schemaVersion: "1"
type: "rule"
id: "edge-auth-key-where-identity"
severity: "info"
select:
  edge: {}
when:
  all:
    - field: "auth"
      in: ["api-key", "basic"]
    - to:
        provider: ["azure", "aws", "gcp"]
message: "Edge '{{edge.from}}' -> '{{edge.to}}' authenticates with a key or a password to a cloud service that accepts an identity. Use managed-identity (Azure), iam-role (AWS) or service-account (Google Cloud)."
```

Human page: https://localhost:3000/catalogue/rules/edge-auth-key-where-identity