mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
65 lines
4.6 KiB
Plaintext
65 lines
4.6 KiB
Plaintext
---
|
|
title: Machine Identities
|
|
description: "Learn how to use Machine Identities to programmatically interact with Infisical."
|
|
---
|
|
|
|
## Concept
|
|
|
|
An Infisical machine identity is an entity that represents a workload or application that require access to various resources in Infisical. This is conceptually similar to an IAM user in AWS or service account in Google Cloud Platform (GCP).
|
|
|
|
Each identity must authenticate with the Infisical API using a supported authentication method like [Universal Auth](/documentation/platform/identities/universal-auth), [Kubernetes Auth](/documentation/platform/identities/kubernetes-auth), [AWS Auth](/documentation/platform/identities/aws-auth), [Azure Auth](/documentation/platform/identities/azure-auth), or [GCP Auth](/documentation/platform/identities/gcp-auth) to get back a short-lived access token to be used in subsequent requests.
|
|
|
|
|
|
|
|
Key Features:
|
|
|
|
- Role Assignment: Identities must be assigned [roles](/documentation/platform/role-based-access-controls). These roles determine the scope of access to resources, either at the organization level or project level.
|
|
- Auth/Token Configuration: Identities must be configured with corresponding authentication methods and access token properties to securely interact with the Infisical API.
|
|
|
|
## Workflow
|
|
|
|
A typical workflow for using identities consists of four steps:
|
|
|
|
1. Creating the identity with a name and [role](/documentation/platform/role-based-access-controls) in Organization Access Control > Machine Identities.
|
|
This step also involves configuring an authentication method for it.
|
|
2. Adding the identity to the project(s) you want it to have access to.
|
|
3. Authenticating the identity with the Infisical API based on the configured authentication method on it and receiving a short-lived access token back.
|
|
4. Authenticating subsequent requests with the Infisical API using the short-lived access token.
|
|
|
|
## Authentication Methods
|
|
|
|
To interact with various resources in Infisical, Machine Identities are able to authenticate using:
|
|
|
|
- [Universal Auth](/documentation/platform/identities/universal-auth): A platform-agnostic authentication method that can be configured on an identity suitable to authenticate from any platform/environment.
|
|
- [Kubernetes Auth](/documentation/platform/identities/kubernetes-auth): A Kubernetes-native authentication method for applications (e.g. pods) to authenticate with Infisical.
|
|
- [AWS Auth](/documentation/platform/identities/aws-auth): An AWS-native authentication method for AWS services (e.g. EC2, Lambda functions, etc.) to authenticate with Infisical.
|
|
- [Azure Auth](/documentation/platform/identities/azure-auth): An Azure-native authentication method for Azure resources (e.g. Azure VMs, Azure App Services, Azure Functions, Azure Kubernetes Service, etc.) to authenticate with Infisical.
|
|
- [GCP Auth](/documentation/platform/identities/gcp-auth): A GCP-native authentication method for GCP resources (e.g. Compute Engine, App Engine, Cloud Run, Google Kubernetes Engine, IAM service accounts, etc.) to authenticate with Infisical.
|
|
- [OIDC Auth](/documentation/platform/identities/oidc-auth): A platform-agnostic JWT-based authentication method for any workloads using an OpenID Connect identity provider.
|
|
|
|
## FAQ
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="Can I use machine identities with the CLI?">
|
|
|
|
Yes - Identities can be used with the CLI.
|
|
|
|
You can learn more about how to do this in the CLI quickstart [here](/cli/usage).
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="What is the difference between an identity and service token?">
|
|
A service token is a project-level authentication method that is being deprecated in favor of identities. The service token method will be removed in the future in accordance with the deprecation notice and timeline stated [here](https://infisical.com/blog/deprecating-api-keys).
|
|
|
|
Amongst many differences, identities provide broader access over the Infisical API, utilizes the same
|
|
permission system as user identities, and come with a significantly larger number of configurable authentication and security features.
|
|
</Accordion>
|
|
<Accordion title="Why can I not create, read, update, or delete an identity?">
|
|
There are a few reasons for why this might happen:
|
|
|
|
- You have insufficient organization permissions to create, read, update, delete identities.
|
|
- The identity you are trying to read, update, or delete is more privileged than yourself.
|
|
- The role you are trying to create an identity for or update an identity to is more privileged than yours.
|
|
</Accordion>
|
|
</AccordionGroup>
|