D10 · Cloud & Workload Identity
Identity and access management for cloud infrastructure, cloud-native services, and software workloads.
Key knowledge areas
- AWS IAM
- Microsoft Azure IAM
- Google Cloud IAM
- Cloud Service Principals
- Azure Managed Identities
- GCP Service Accounts
- AWS IAM Roles
- Kubernetes Service Accounts
- Kubernetes RBAC
- Workload Identity Federation
- SPIFFE / SPIRE
- SPIFFE Verifiable Identity Documents (SVID)
- Mutual TLS (mTLS)
- Service-to-Service Authentication
- Short-Lived Workload Credentials
- Cloud Secrets Management
- Infrastructure Identity
- Workload Identity Lifecycle
Career alignment
- TRACK A — Identity Platform & CIAM Engineering: Core domain. View track
- TRACK B — Enterprise IAM / PAM / IGA Engineering: Supporting domain. View track
Suggested learning outcomes
- Constrain workload federation and cloud permissions.
- Explain managed identities and SPIFFE/SPIRE trust.
These prompts are editorial learning aids retained from the earlier textbook. They are not additional requirements in v0.4.
Connected questions
- How should a DevOps engineer reach production?
- Who owns the identity connecting to your database?
- When an AI agent acts, whose authority does it use?
Build competency evidence
Explain a mechanism, analyze an implementation or failure, build a tested lab, and justify an architecture. Keep shared technical explanations in the Knowledge Base and link to them from research.
Domain name, scope, knowledge areas and representative technologies follow the authoritative Framework v0.4. Questions may span multiple domains.
D09 · Non-Human Identity (NHI)
Identification, authentication, authorization, lifecycle management, and governance of non-human principals across enterprise environments.
D11 · Identity Security & Zero Trust
Security architecture, threat detection, attack prevention, and incident response relating to identity systems.