Cloud Native Data Security with OAuth

Chapter 10. Workload Identities

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the authors’ raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 10th chapter of the final book. The GitHub repo is available at https://github.com/curityio/cloud-native-oauth-security-examples.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

Once you complete your API authorization and deploy your APIs to Kubernetes, you are likely to have some further API security requirements, since OAuth alone does not solve all API security problems. Some security best practices, like hardening of containers and authorizing access to Kubernetes cluster resources, are outside the scope of this book. Instead, we want to highlight some characteristics of cloud-native environments that can help to meet the following OAuth-related requirements:

• Malicious parties must be unable to read confidential internal API traffic.

• Only trusted clients must be able to reach the target APIs.

• Malicious parties must be unable to impersonate your APIs by using its secrets.

• Malicious parties must be unable to gain API access with a stolen token.

Cloud native infrastructure security provides additional building blocks that enable ...