Stop Rotating Keys! What If We Dared Credential-less?
summary
The talk explains how to move from manual credential handling and frequent key rotation to a ‘credential-less’ infrastructure using OAuth and identity federation. It shows concrete tools and workflows — GitHub Actions, GCP, Kubernetes, and Vault for dynamic credentials — to automate authentication from build to run and secure access to data stores like MongoDB and PostgreSQL.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:45Avoiding key rotation
- 4:46OAuth2 identity management
- 13:48Workload Identity Federation
- 21:25GKE credential-less auth
- 25:11Securing PostgreSQL access
- 35:07Demo: auto rotation
- 39:09Summary and best practices
- 40:31Q&A
related talks
45mAttackers' Nightmare: An Infrastructure Without Secrets
30mLong Live Short Lived Credentials - Auto-rotating Secrets At Scale
46mThe Nightmare for Attackers: An Infrastructure without Secrets
28mYour journey to temporary credentials in the cloud
44mSecrets at Scale: Managing Cloud Credentials with PowerShell Automation
26mRefactoring Applications for Dynamic Secrets
40mNOPASSWD: Building a Passwordless Cloud Infrastructure
29mI Can OIDC You Clearly Now: How We Made Static Credentials a...