Topic starter
27/08/2025 12:10 pm
TL;DR: Snowflake says its workload IAM rollout with Aembit cut 85% of credential issuance, rotation, and auditing follow-up while reducing manual oversight across workload access, according to Snowflake. The shift shows that secretless access improves control, but only if identity, policy, and audit evidence are governed as one system.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “Case Study”.
By the numbers:
- Aembit says Snowflake cut 85% of credential issuance, credential rotation and auditing follow-up after shifting to secretless workload access.
Key questions
Q: What breaks when workload access still depends on static secrets?
A: Static secrets create persistent access paths that outlive the workload, which makes compromise easier to exploit and harder to contain.
Q: Why do long-lived workload credentials increase governance and audit risk?
A: They force teams to maintain separate processes for issuance, rotation, ownership and compliance evidence.
Q: How can teams tell whether workload access is still too secret-driven?
A: A strong signal is finding access keys embedded in source code, environment variables, old infrastructure or CI/CD pipelines with no clear owner.
Practitioner guidance
- Audit workload credentials with standing reuse Identify service accounts and access credentials that persist beyond their original workload purpose, especially where multiple applications or humans touch them.
- Move issuance to runtime policy checks Require workload access requests to be evaluated at the moment of use, with short-lived credentials issued only after policy conditions are met.
- Add workload posture checks before access Verify that the requesting workload is in an expected managed state before issuing credentials, rather than trusting the request path alone.
Bottom line: Workload IAM addresses a familiar NHI problem: static credentials make access hard to govern once they are stored, reused and rotated manually.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:36 pm
Secretless access does not remove the governance problem, it relocates it. The central question is no longer where to store the secret, but how access is issued, checked and evidenced at the moment of use. That is why workload IAM must be treated as an identity governance control plane, not a convenience layer. Practitioners should judge the design by whether it closes the loop between request, policy decision and audit record.
A question worth separating out:
Q: What should IAM teams do when workload identity spans multiple services?
A: Treat the workload identity as the governed object, not each individual secret. That means mapping the access path, defining policy conditions for the workload’s context, and keeping a single system of record for issuance and review across the services it touches.
👉 Read our full editorial: Workload IAM exposes the secretless governance gap for NHI access