SPIFFE (Secure Production Identity Framework for Everyone) is a standard for assigning cryptographic identities to software workloads. A workload may be a service, job, container, function, or agent. Its SPIFFE ID names the workload, while an SVID (SPIFFE Verifiable Identity Document) lets it prove that identity. section 11.1.2
In service-to-service communication, an SVID can be an X.509 certificate or JWT used to establish mutually authenticated TLS. A sidecar, proxy, or policy enforcement point can extract the authenticated workload identity and pass it to authorization policy. section 11.1.2 section 12.5.2
SPIFFE supplies identity evidence rather than the authorization decision:
- Identifies which workload made a request and provides cryptographic proof of that identity. section 11.1.2
- Lets a policy enforcement point include the workload as the principal while preserving employee, tenant, action, resource, sensitivity, and runtime context. section 11.1.2
- Does not replace Cedar or the policy decision point; those components still determine whether the request is allowed. section 11.1.2 section 12.5.2
Service identity in a mesh
A Docs service proves its identity through mTLS. Its sidecar supplies the Docs workload identity to policy, which can then evaluate whether the service may index a document. The policy may still deny documents classified as Legal. section 11.1.2
spiffe://acme.example/customer-collaboration/docs-service
A SPIFFE ID is represented as a URI naming a specific workload, such as the Docs service in a customer-collaboration environment. section 11.1.2
