<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-machine-identity-management
description: >-
  Manage non-human identities including API keys, service accounts, certificates, secrets, workload identities, and IoT device credentials. Covers machine identity lifecycle, certificate management with PKI, secrets rotation, workload identity federation, and SPIFFE/SPIRE implementations.
domain: cybersecurity
subdomain: identity-security
tags:
  - machine-identity
  - PKI
  - certificates
  - secrets-management
  - SPIFFE
  - workload-identity
  - service-accounts
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "PR.AC-1"
  - "PR.AC-7"
  - "PR.DS-2"
  - "PR.IP-1"
  - "PR.MA-1"
  frameworks:
  - "SPIFFE/SPIRE"
  - "NIST SP 800-57"
  - "CIS Controls v8"
  - "X.509"
  mitre-attack: ["T1552.004"]
---

# Performing Machine Identity Management

## Overview

Machine identity management addresses the fastest-growing attack surface in
modern environments — non-human identities outnumber human identities 45:1.
This skill covers the full lifecycle of API keys, certificates, service accounts,
workload identities, and IoT credentials including discovery, governance,
rotation, and compromise detection.

## Workflow

1. **Machine Identity Discovery** — Scan environments for all non-human identities (certs, keys, service accounts, tokens)
2. **Inventory Classification** — Categorize by type, owner, criticality, and associated workload
3. **Lifecycle Policy Definition** — Establish creation, rotation, and revocation policies per identity type
4. **PKI Architecture** — Design or audit certificate authority hierarchy and issuance policies
5. **Secrets Management Deployment** — Implement centralized vault with dynamic secrets and lease management
6. **Workload Identity Federation** — Configure SPIFFE/SPIRE or cloud-native workload identity for service-to-service auth
7. **Rotation Automation** — Build automated credential rotation pipelines with zero-downtime deployment
8. **Monitoring and Alerting** — Deploy certificate expiry monitoring, key usage anomalies, and compliance reporting

## Key Concepts

### Machine Identity Types

| Type | Lifecycle | Rotation Period | Risk |
|------|----------|----------------|------|
| X.509 Certificates | CA-issued, time-bound | 90-397 days | Expiry outage |
| API Keys | Self-generated, static | 90 days | Leak exposure |
| Service Account Passwords | Directory-managed | 60-90 days | Credential stuffing |
| OAuth Client Secrets | IdP-issued | 180 days | Secret sprawl |
| SSH Keys | User-generated | Annual | Unmanaged proliferation |
| Workload Identity Tokens | SPIFFE, short-lived | Minutes | Token theft |
| IoT Device Certificates | PKI-issued | 1-5 years | Mass compromise |

### SPIFFE/SPIRE Architecture

| Component | Function |
|-----------|----------|
| SPIFFE ID | Uniform identity (spiffe://trust-domain/workload) |
| SVID | SPIFFE Verifiable Identity Document (X.509 or JWT) |
| SPIRE Server | Identity attestation and SVID issuance |
| SPIRE Agent | Node-level workload API provider |
| Workload API | Unix domain socket for SVID retrieval |

### Certificate Lifecycle States

| State | Description | Monitoring Action |
|-------|-------------|------------------|
| Issued | Active and valid | Track in inventory |
| Expiring (30d) | Approaching expiry | Alert certificate owner |
| Expiring (7d) | Critical window | Escalate to management |
| Expired | No longer valid | Emergency replacement |
| Revoked | Compromised or decommissioned | Verify CRL/OCSP propagation |
| Orphaned | No known owner | Investigate and remediate |

## Detection Opportunities

### Machine Identity Threat Indicators

- **Certificate anomalies**: unexpected CA issuance, wildcard cert proliferation, self-signed in production
- **Key exposure**: API keys in public repos, environment variables in logs, unencrypted storage
- **Rotation failures**: credentials past rotation deadline, orphaned service accounts
- **Usage anomalies**: service account used from unexpected source, cert used after revocation
- **MITRE mapping**: T1552 (Unsecured Credentials), T1588.004 (Obtain Capabilities: Digital Certificates), T1553.004 (Subvert Trust Controls: Install Root Certificate)

```yaml
title: Machine Identity Management Detection
id: c743ee93-8f86-4625-ae31-6093db951fb2
status: experimental
description: Detects suspicious activity related to performing machine identity management techniques in identity security context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: high
tags:
  - attack.t1552.004
  - attack.credential_access
falsepositives:
  - Service account authentication during scheduled batch processing
```

## Quick Reference

```bash
node scripts/agent.js analyze --target <scope>
```
