> ## Documentation Index > Fetch the complete documentation index at: https://controlplanecorporation-majid-docs-content-expansion.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Identity > One identity for everything a workload reaches: a policy decides which secrets it may read, a cloud account decides which provider services it may call with no stored key, and a wormhole agent or native networking decides which private hosts it may dial. An identity is what you attach to a [workload](/concepts/workload) to give it credentials, and a workload takes at most one, so that identity is its whole credential surface. Widening what a workload may reach means changing the identity rather than the workload. An identity belongs to a [GVC](/concepts/gvc), and the workloads in that GVC share it when they need the same access. ## How It Fits An EC2 instance holds no AWS keys: it is given an IAM role, and AWS hands its SDKs short-lived credentials for that role. An identity does the same for a workload, in every provider it holds a [cloud account](/reference/cloudaccount) for. | What the workload reaches | How you grant it | What the container gets | | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | A [secret](/reference/secret) | A [policy](/concepts/access-control) giving the identity `reveal` on that secret | The value, resolved from a `cpln://secret/my-secret` reference | | A cloud provider service | A cloud account on the identity, plus the roles it should hold there | Short-lived provider credentials, which its own SDK finds without configuration | | A host inside a private network | A [wormhole agent](/reference/agent) running in that network, plus the host and ports to open | A name it can dial, over the agent's outbound tunnel | | A service that never leaves a VPC | [Native networking](/guides/native-networking/native-networking-setup) over AWS PrivateLink or GCP Private Service Connect, wired by Control Plane support | The same, over the provider's own private network | A workload has one identity attached to it, and that identity is its route out. The workload my-app uses the identity my-identity. Arrows labeled reaches fan out from the identity to four destinations: the secret my-db-password, the cloud service s3://my-bucket marked with the Amazon S3 logo, the private host db.internal, and the VPC service payments.internal. A workload takes one identity, and that identity holds everything the workload may reach. ## Key Behaviors * **The firewall and the identity answer different questions.** The [firewall](/reference/workload/firewall) decides where a container may connect. The identity decides who it is when it gets there. Reaching a public API takes a firewall rule; reading your own S3 bucket takes a firewall rule and an identity. * **Reading a secret takes three things, not one.** The identity is attached to the workload, a policy grants that identity `reveal` on the secret, and the container references it as `cpln://secret/my-secret`. One key of a dictionary secret is addressed as `cpln://secret/my-secret.username`. * **[Universal Cloud Identity](/reference/identity#cloud-provider-access) provisions in your cloud, not in ours.** Giving an identity a cloud block creates one principal for it inside your own account, named after the org, GVC, and identity and tagged with all three: an IAM role on AWS, a service account on GCP, a managed identity or app registration on Azure. Control Plane then serves that provider's own instance metadata endpoint inside the workload, so an unmodified SDK finds short-lived credentials exactly where it already looks for them. * **One identity covers every provider at once, one account each.** It carries at most one AWS, one GCP, one Azure, and one NATS cloud account, so a workload that reads from S3 and writes to BigQuery needs one identity rather than two. Per provider you either list the permissions for Control Plane to create a principal, or name an existing role or service account to attach to. * **A private host is reached by name.** Name the host, the ports to open, and the agent that can see it, and the workload dials that name as though it were local, on those ports only. The agent makes the connection to Control Plane itself, so the private network needs only outbound access, and the route opens without an outbound firewall rule on the workload. * **Provisioning reports itself per provider.** Each cloud block on the identity says whether it is usable and carries the last error if it is not, which is where a refused role creation surfaces. Read it there before debugging the container. ## Gotchas * **Every container in a workload shares its identity.** The link is per workload, not per container, so a sidecar holds the same cloud access the application does. Containers that need different access belong in separate workloads. * **`reveal` is the permission that returns a secret's value.** `view` returns the metadata and never the plaintext, and it is the most common wrong grant in the chain. `edit` returns the value too, because `edit` implies `reveal`: anyone who can change a secret can read it. * **A broken chain names itself and pauses the deployment.** Control Plane resolves every secret reference before rolling the workload out, and puts the reason on the workload: `The identity my-identity is not allowed to reveal the secret my-db-password. Workload updates are paused until the identity is granted access or the reference to the secret is removed.` A missing identity and a deleted secret each get their own message. * **A wrong key inside a secret is the failure that does stay silent.** That check resolves the secret's name, not the key after the dot, so `cpln://secret/my-secret.usrname` passes it and still arrives empty. Check the key against the secret when a value is missing and the workload rolled out clean. * **An identity can be as powerful as the cloud account allows.** Control Plane's connector attaches whatever policies the identity lists to the role it creates in your account, up to full administrator. Grant `create` and `edit` on identities to administrators only, with a policy. ## Learn More Every field for the four provider blocks, network resources, and status. Build one and grant it cloud access from the Console or the CLI. The IAM setup each provider needs before an identity can draw credentials. How policies grant permission, and where identities sit among the principals.