Notifications
Clear all
Topic starter
07/06/2026 9:26 pm
TL;DR: Managing identity with Terraform replaces manual dashboard changes with versioned code, peer review, and repeatable deployment for users, policies, entitlements, and access profiles, according to ConductorOne. That shifts identity governance from click-based administration to auditable, recoverable infrastructure practice, while secret rotation and policy misconfiguration become code problems instead of tribal knowledge problems.
NHIMG editorial — based on content published by ConductorOne: Managing Identity as Code: How to Use Terraform with C1
By the numbers:
- Brex used Terraform to update 400 entitlement policies in just a few days.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should IAM teams use Terraform to govern identity changes safely?
A: Use Terraform to define identity objects, approval rules, and access profiles in version-controlled code, then require peer review before changes are applied.
Q: Why does managing identity as code help with NHI governance?
A: Non-human credentials and access policies often spread across systems, so manual administration leaves gaps that are hard to see and harder to reverse.
Q: What breaks when identity policies are updated manually instead of as code?
A: Manual updates increase the chance of misconfiguration, undocumented changes, and inconsistent access across environments.
Practitioner guidance
- Put identity changes under version control Store users, groups, policies, and access profiles in Git so reviewers can inspect every change before it reaches production and so rollback is possible when a bad change slips through.
- Automate secret rotation for integrations Use code-driven workflows to rotate API keys and secrets on a planned cadence, then update dependent settings before expiry so external integrations do not fail when credentials expire.
- Standardise entitlement bundles Define access profiles as reusable bundles with clear ownership and request rules, then manage changes through pull requests so entitlement sprawl does not grow through one-off manual grants.
What's in the full article
ConductorOne's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step Terraform patterns for defining identity objects, policies, and access profiles in C1.
- Operational handling of secret rotation for integrations that depend on API keys or other credentials.
- The Brex example showing how 400 entitlement policies were updated in a few days.
- Practical notes on applying version control and approvals to identity changes.
👉 Read ConductorOne's guide to managing identity as code with Terraform →
Terraform for identity governance: what IAM teams need to know?
Explore further
08/06/2026 9:23 am
Identity as code is a governance model, not just an automation layer. The value is not simply that Terraform reduces manual work. It changes identity management into a controlled change process with review, rollback, and history, which is what mature IAM programmes need when access decisions affect both human users and non-human identities. Practitioners should treat this as governance architecture, not convenience tooling.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- Only 97% of NHIs carry excessive privileges, which is why code-defined access review matters before access sprawl becomes normalised.
A question worth separating out:
Q: How can teams tell whether identity as code is actually working?
A: Look for lower configuration drift, faster review cycles, fewer emergency access fixes, and a complete change history that matches the live environment. If identity changes still require ad hoc console edits or cannot be reproduced from code, the programme is only partially governed. The code should define the intended state, not just document it.
👉 Read our full editorial: Managing identity as code for policies, secrets, and access
