The Disposable Identity: Eliminating Non-Human Identity Risk in Federal Healthcare...
summary
Production deployment of an Identity-Per-Transaction pipeline on AWS replaces 90‑day service accounts with unique, cryptographically scoped ephemeral credentials per file, issued by a broker and valid up to 900 seconds. Pipeline uses S3 events, Lambda/Glue compute, Presidio for NLP deidentification, and STS AssumeRole timing averages ~180 ms (cold starts 340–440 ms). Pilot sustains 40 identities/min in batches, stress tests hit 3,000 concurrent Lambdas without exceeding 2,000 STS/s. Race condition and broker root‑of‑trust limits remain open; code is available as pi-mayfly.
AI-written summary · about
chapters (9)
- 0:00Non-human identity risks
- 2:14AWS identity challenges
- 4:19Ephemeral identity framework
- 7:05Performance metrics and results
- 8:50Security logging and audits
- 10:39Root of trust safeguards
- 12:22Limitations and research
- 14:13Pipeline isolation benefits
- 15:19Future work and collaborations
related talks
26mZero Trust in 200ms: Implementing Identity-Per-Transaction with Python
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords
34mZero trust CI/CD pipeline
29mWorkload Identity for Humans: A Twelve-Factor Approach
44mAchieve your identity, security, and compliance goals on
34mThrow Away Your Passwords: Trusting Workload Identity
50mDestroying Long-Lived Cloud Credentials with Workload Identity Federation
22mHow to Secure Cloud Machine Identities