Identity

One identity for everything a workload reaches: a policy decides which secrets it may read, a cloud account decides which provider services it may call with no stored key, and a wormhole agent or native networking decides which private hosts it may dial.

An identity is what you attach to a workload to give it credentials, and a workload takes at most one, so that identity is its whole credential surface. Widening what a workload may reach means changing the identity rather than the workload. An identity belongs to a GVC, and the workloads in that GVC share it when they need the same access.

How It Fits

An EC2 instance holds no AWS keys: it is given an IAM role, and AWS hands its SDKs short-lived credentials for that role. An identity does the same for a workload, in every provider it holds a cloud account for.

What the workload reaches	How you grant it	What the container gets
A secret	A policy giving the identity reveal on that secret	The value, resolved from a cpln://secret/my-secret reference
A cloud provider service	A cloud account on the identity, plus the roles it should hold there	Short-lived provider credentials, which its own SDK finds without configuration
A host inside a private network	A wormhole agent running in that network, plus the host and ports to open	A name it can dial, over the agent’s outbound tunnel
A service that never leaves a VPC	Native networking over AWS PrivateLink or GCP Private Service Connect, wired by Control Plane support	The same, over the provider’s own private network

Key Behaviors

• The firewall and the identity answer different questions. The firewall decides where a container may connect. The identity decides who it is when it gets there. Reaching a public API takes a firewall rule; reading your own S3 bucket takes a firewall rule and an identity.
• Reading a secret takes three things, not one. The identity is attached to the workload, a policy grants that identity reveal on the secret, and the container references it as cpln://secret/my-secret. One key of a dictionary secret is addressed as cpln://secret/my-secret.username.
• Universal Cloud Identity provisions in your cloud, not in ours. Giving an identity a cloud block creates one principal for it inside your own account, named after the org, GVC, and identity and tagged with all three: an IAM role on AWS, a service account on GCP, a managed identity or app registration on Azure. Control Plane then serves that provider’s own instance metadata endpoint inside the workload, so an unmodified SDK finds short-lived credentials exactly where it already looks for them.
• One identity covers every provider at once, one account each. It carries at most one AWS, one GCP, one Azure, and one NATS cloud account, so a workload that reads from S3 and writes to BigQuery needs one identity rather than two. Per provider you either list the permissions for Control Plane to create a principal, or name an existing role or service account to attach to.
• A private host is reached by name. Name the host, the ports to open, and the agent that can see it, and the workload dials that name as though it were local, on those ports only. The agent makes the connection to Control Plane itself, so the private network needs only outbound access, and the route opens without an outbound firewall rule on the workload.
• Provisioning reports itself per provider. Each cloud block on the identity says whether it is usable and carries the last error if it is not, which is where a refused role creation surfaces. Read it there before debugging the container.

Gotchas

• Every container in a workload shares its identity. The link is per workload, not per container, so a sidecar holds the same cloud access the application does. Containers that need different access belong in separate workloads.
• reveal is the permission that returns a secret’s value. view returns the metadata and never the plaintext, and it is the most common wrong grant in the chain. edit returns the value too, because edit implies reveal: anyone who can change a secret can read it.
• A broken chain names itself and pauses the deployment. Control Plane resolves every secret reference before rolling the workload out, and puts the reason on the workload: The identity my-identity is not allowed to reveal the secret my-db-password. Workload updates are paused until the identity is granted access or the reference to the secret is removed. A missing identity and a deleted secret each get their own message.
• A wrong key inside a secret is the failure that does stay silent. That check resolves the secret’s name, not the key after the dot, so cpln://secret/my-secret.usrname passes it and still arrives empty. Check the key against the secret when a value is missing and the workload rolled out clean.
• An identity can be as powerful as the cloud account allows. Control Plane’s connector attaches whatever policies the identity lists to the role it creates in your account, up to full administrator. Grant create and edit on identities to administrators only, with a policy.

Learn More

Identity reference

Every field for the four provider blocks, network resources, and status.

Create an Identity

Build one and grant it cloud access from the Console or the CLI.

Cloud Account

The IAM setup each provider needs before an identity can draw credentials.

Access Control

How policies grant permission, and where identities sit among the principals.