# Identity transition

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

The direction from static long-lived secrets to short-lived workload identity is followed only where the evidence supports it. This document states the facts of the source and what stays open; it makes no statement about whether federation is an option for any workload.

## Workloads and identities

| Unit | Type | Bindings | Static credential | Federation facts | Target attachment | Workload identity federation | Privilege delta | Break-glass access | Human identity | State |
|---|---|---|---|---|---|---|---|---|---|---|
| google_cloud_run_v2_job.migrate | google_cloud_run_v2_job | google_cloud_run_v2_job.migrate#template[0].template[0].service_account (RUNTIME, SERVICE ACCOUNT, KNOWN) | NOT ASSESSED |  | OPEN | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | DECISION REQUIRED |
| google_cloud_run_v2_service.server | google_cloud_run_v2_service | google_cloud_run_v2_service.server#template[0].service_account (RUNTIME, SERVICE ACCOUNT, KNOWN) | NOT ASSESSED |  | OPEN | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | DECISION REQUIRED |

## What each row says

### `google_cloud_run_v2_job.migrate`

The identity plan states the attachment of this workload and writes none: whether STACKIT accepts the role assignments an attached account needs is not established. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.

Items: the step "Decide how google_cloud_run_v2_job.migrate gets its application identity on…" (`MAN/identity/facts:google_cloud_run_v2_job.migrate:google_cloud_run_v2_job.migrate.template.0.template.0.service_account-8dc3e1`)

### `google_cloud_run_v2_service.server`

The identity plan states the attachment of this workload and writes none: whether STACKIT accepts the role assignments an attached account needs is not established. The plan holds manual actions or open decisions for it; they are listed as items. Privilege delta, break-glass access and human identity are not assessed.

Items: the step "Decide how google_cloud_run_v2_service.server gets its application identity on…" (`MAN/identity/facts:google_cloud_run_v2_service.server:google_cloud_run_v2_service.server.template.0.service_account-5ccce9`)

## Limits

- Workload identity federation is not assessed as an option for any workload. A row states an OIDC issuer where the source names one, as a fact of the source, and never that federation can replace a key.
- A static credential is named only where the knowledge base reads a machine user with access keys on the unit. A scan that finds no key cannot say a workload has none, so the absence of a credential is never written.
- Privilege delta, break-glass access and human identity are not assessed for any row.
- A workload that names no identity in the source has no row, and a run whose draft held no identity intents lists only the units that are an identity themselves.
- The block states what the identity plan holds open. It does not attach, grant or federate anything.