Pathfinder Workload Credentials

Workloads prove who they are with their runtime identity tokens. No bootstrap credential is needed.

• GitHub Actions: workflows authenticate using GitHub's OIDC tokens.
• Kubernetes: service accounts authenticate through the cluster's OIDC issuer.
• Custom OIDC issuers: any standards-compliant OIDC issuer can be configured as a trust.

• The Workload Credentials GitHub Action (beyondtrust/workload-credentials-action) is published in the GitHub Marketplace.
• A few lines of workflow YAML retrieve secrets and dynamic AWS credentials without any static keys stored in GitHub.

The BeyondTrust Terraform provider is published to the Terraform Registry.

Trusts, secrets, folders, integrations, and access policies can all be managed as code .

• Workload Credentials is integrated with platform RBAC, including built-in roles.
• Resource lists are filtered to what each user or identity is permitted to see.
• Access policies can be managed through the API and the Terraform provider.

Secret access, credential issuance, policy changes, and configuration changes are captured in the Audit Logging system.

Audit data is available through dashboards.

Kubernetes workloads can sync secrets from Workload Credentials using the External Secrets Operator.

Integration with Microsoft Azure, focusing on dynamic credential generation to minimize the risks associated with long-lived service principal credentials.

• Ephemeral credentials: Generate short-lived Microsoft Entra ID service principal credentials on demand for existing Azure app registrations.
• Configurable expiration: Credential lifetimes can be configured between 1 and 24 hours.
• Automatic revocation: Generated credentials are automatically revoked upon expiration, with support for manual revocation of active leases.
• Least-privilege access: Generated credentials inherit the permissions and roles assigned to the target app registration.

• Configuration: Dedicated UI workflows for configuring Azure connectors using Microsoft Entra ID app registrations.
• Dynamic Secret Management: UI workflows for creating dynamic secret configurations and generating Azure credentials.
• Lease Management: View active credential leases and manually revoke credentials before expiration.