# Identity transition

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

The direction from static long-lived secrets to short-lived workload identity is followed only where the evidence supports it. This document states the facts of the source and what stays open; it makes no statement about whether federation is an option for any workload.

## Workloads and identities

| Unit | Type | Bindings | Static credential | Federation facts | Target attachment | Workload identity federation | Privilege delta | Break-glass access | Human identity | State |
|---|---|---|---|---|---|---|---|---|---|---|
| module.retail_app_ecs.module.carts_service.aws_ecs_service.this | aws_ecs_service | module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#execution_role_arn (EXECUTION, ROLE, KNOWN); module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this#task_role_arn (TASK, ROLE, KNOWN) | NOT ASSESSED |  | OPEN | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | DECISION REQUIRED |
| module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | aws_ecs_service | module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#execution_role_arn (EXECUTION, ROLE, KNOWN); module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this#task_role_arn (TASK, ROLE, KNOWN) | NOT ASSESSED |  | OPEN | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | DECISION REQUIRED |
| module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | aws_ecs_service | module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#execution_role_arn (EXECUTION, ROLE, KNOWN); module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this#task_role_arn (TASK, ROLE, KNOWN) | NOT ASSESSED |  | OPEN | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | DECISION REQUIRED |
| module.retail_app_ecs.module.orders_service.aws_ecs_service.this | aws_ecs_service | module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#execution_role_arn (EXECUTION, ROLE, KNOWN); module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this#task_role_arn (TASK, ROLE, KNOWN) | NOT ASSESSED |  | OPEN | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | DECISION REQUIRED |
| module.retail_app_ecs.module.ui_service.aws_ecs_service.this | aws_ecs_service | module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#execution_role_arn (EXECUTION, ROLE, KNOWN); module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this#task_role_arn (TASK, ROLE, KNOWN) | NOT ASSESSED |  | OPEN | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | DECISION REQUIRED |

## What each row says

### `module.retail_app_ecs.module.carts_service.aws_ecs_service.this`

The identity plan does not attach a service account to this workload exactly; the attachment is a decision of a person. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.

Items: the step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.execution_role_arn-586451`), the step "Decide how module.retail_app_ecs.module.carts_service.aws_ecs_service.this gets…" (`MAN/identity/facts:module.retail_app_ecs.module.carts_service.aws_ecs_service.this:module.retail_app_ecs.module.carts_service.aws_ecs_task_definition.this.task_role_arn-686488`)

### `module.retail_app_ecs.module.catalog_service.aws_ecs_service.this`

The identity plan does not attach a service account to this workload exactly; the attachment is a decision of a person. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.

Items: the step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.execution_role_arn-dedc98`), the step "Decide how module.retail_app_ecs.module.catalog_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.catalog_service.aws_ecs_service.this:module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this.task_role_arn-15a967`)

### `module.retail_app_ecs.module.checkout_service.aws_ecs_service.this`

The identity plan does not attach a service account to this workload exactly; the attachment is a decision of a person. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.

Items: the step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.execution_role_arn-b70bc2`), the step "Decide how module.retail_app_ecs.module.checkout_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.checkout_service.aws_ecs_service.this:module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this.task_role_arn-9651e2`)

### `module.retail_app_ecs.module.orders_service.aws_ecs_service.this`

The identity plan does not attach a service account to this workload exactly; the attachment is a decision of a person. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.

Items: the step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.execution_role_arn-eacc48`), the step "Decide how module.retail_app_ecs.module.orders_service.aws_ecs_service.this…" (`MAN/identity/facts:module.retail_app_ecs.module.orders_service.aws_ecs_service.this:module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this.task_role_arn-d0b927`)

### `module.retail_app_ecs.module.ui_service.aws_ecs_service.this`

The identity plan does not attach a service account to this workload exactly; the attachment is a decision of a person. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.

Items: the step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this pulls…" (`MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.execution_role_arn-2d22d2`), the step "Decide how module.retail_app_ecs.module.ui_service.aws_ecs_service.this gets…" (`MAN/identity/facts:module.retail_app_ecs.module.ui_service.aws_ecs_service.this:module.retail_app_ecs.module.ui_service.aws_ecs_task_definition.this.task_role_arn-0c66b7`)

## Limits

- Workload identity federation is not assessed as an option for any workload. A row states an OIDC issuer where the source names one, as a fact of the source, and never that federation can replace a key.
- A static credential is named only where the knowledge base reads a machine user with access keys on the unit. A scan that finds no key cannot say a workload has none, so the absence of a credential is never written.
- Privilege delta, break-glass access and human identity are not assessed for any row.
- A workload that names no identity in the source has no row, and a run whose draft held no identity intents lists only the units that are an identity themselves.
- The block states what the identity plan holds open. It does not attach, grant or federate anything.