Machine and Nonhuman Identity Security (Secrets Management)
Machine and Nonhuman Identity Security (Secrets Management)
This domain tests how workloads authenticate and obtain secrets without humans in the loop. Expect questions on CyberArk Secrets Manager/Conjur policy, workload identity, secret retrieval, rotation, and removing hardcoded credentials.
Core rules
- Machine identity is established by an authenticator, not a shared password. Workloads prove identity with a platform-issued token such as JWT, cloud instance identity, or Kubernetes service account identity.
- Conjur-style policy is code: layers group hosts, hosts represent workloads, variables hold secrets, and permits grant entitlements. If a host is not permitted to a variable, authentication alone is not enough.
- Authorization is separate from authentication. A valid workload token still needs an explicit permit to read a secret.
- Prefer short-lived credentials: dynamic secrets with a TTL, fetched at runtime, reduce standing access. Revocation must work when a workload is retired.
- Secretless patterns and credential injection keep secrets out of source code, build logs, and application memory where possible.
- Rotation is only effective when consumers fetch the current value; hardcoded copies defeat it. Certificate and SSH key managers extend the same lifecycle discipline to other credential types.
Worked example
A CI pipeline needs a database password. Instead of storing it as a pipeline variable, the job authenticates with its CI-issued JWT through an authn-jwt authenticator. The JWT maps to a host in the ci layer. Policy grants that host read on db/password. At runtime the job fetches the variable and injects it into the deployment step. Reasoning: the pipeline has a verifiable identity, the entitlement is narrow, and no long-lived secret sits in the repository. If the job is compromised, revoke the host or rotate the variable; both are auditable.
Traps
- Treating a stored API key as workload identity - that is secret zero, not authentication.
- Granting a whole layer access to every variable.
- Using long TTLs because rotation is inconvenient.
- Forgetting revocation and offboarding for machine identities.
- Assuming a successful login proves authorization to the secret.