Setting the file. One moment.
Subchapter 25.10
references/design-refs/identity.mdMarkdown8 KBView on GitHub
Pass-2 rubric for identity and secret types that reach it. Thin by design: Key Vault and user-assigned managed identities are Direct Mappings, so most of this resolves in pass 1.
Outcome is confidence: inferred. Never deterministic.
This file is about WORKLOAD identity — how a running resource authenticates. HUMAN identity is not a resource mapping: it is Clarify category J, it always fires, and it defaults to a fresh IAM Identity Center re-invite, not Entra ID federation (decision 13.5f). Nothing in this file changes that default, and finding managed identities or workload federation in the estate is not consent to federate human sign-in. Defaulting to federation would leave the migration depending on the cloud being left — the exit is not an exit if AWS sign-in breaks when the Entra tenant lapses.
| Candidate | Eliminated when |
|---|---|
| Secrets Manager | the material is a key used for cryptographic operations rather than a stored credential. A key that is wrapped, unwrapped or used to sign belongs in KMS; Secrets Manager stores bytes, it does not perform crypto |
| Secrets Manager | the value is a TLS certificate served by a load balancer. That is ACM |
| Parameter Store | the value needs automatic rotation with a rotation function. That is Secrets Manager |
| IAM user | ALWAYS, for a workload. A managed identity becomes an IAM role assumed by the compute, never a long-lived access key. Emitting an IAM user with keys for a workload that had no keys is a security regression introduced by the migration |
| Source | Target | Why |
|---|---|---|
Microsoft.KeyVault/vaults | Secrets Manager, plus KMS if the vault has keys and ACM if it has certificates | Fast-path row. The split is by what the vault CONTAINS, which is why the row’s note records whether a keys or certificates child was seen |
Microsoft.KeyVault/vaults/secrets | no target — names feed the parent vault | Fast-path skip. Names only, never values — the secret boundary in extract-terraform.md applies |
Microsoft.KeyVault/vaults/keys | KMS key on the parent’s mapping | A key is a crypto object, not a stored string |
Microsoft.KeyVault/vaults/certificates | ACM, or Secrets Manager when the certificate is consumed by application code rather than terminated at a balancer | The consumer decides, and the consumer is visible in the cluster’s edges |
Microsoft.ManagedIdentity/userAssignedIdentities | IAM role | Fast-path row |
.../federatedIdentityCredentials | IRSA or EKS Pod Identity on the parent role | Genuinely equivalent: a Kubernetes service account trades a token for cloud credentials on both sides |
| System-assigned identity (a property, not a resource) | the compute resource’s instance profile or task role | It has no resources[] entry of its own, so it lands in the compute entry’s aws_config |
Microsoft.Authorization/roleAssignments | no target — IAM policy is authored | See § 3 |
Microsoft.AppConfiguration/configurationStores | AppConfig, or Parameter Store for plain key/value | Values are not read; the secret boundary applies to a config store too |
Microsoft.Authorization/roleAssignments and roleDefinitions are Skip Mappings, and
that is a deliberate refusal rather than a gap.
Azure RBAC and AWS IAM differ in the things that matter for a mechanical translation: Azure assigns a role at a scope in a resource hierarchy that AWS does not have; AWS policies attach to principals and carry resource ARNs, conditions and explicit denies with different evaluation semantics. A translated policy would be plausible and wrong, and the failure mode is either a privilege escalation or an outage — both silent until exercised.
So:
identity_grant edge — “app X reads storage Y” is real
architectural information and clustering uses it.azurerm_role_assignment is the one borderline case in the association-only class: it
does have an ARM type, so it gets an inventory entry AND contributes its edge.Least privilege does not survive a mechanical translation. Saying so is more useful than shipping a policy nobody reviewed.
secret_ref is an ambient
edge and never merges clusters (decision 13.4c). One Key Vault commonly serves the whole
estate, and merging on it collapses the partition.Per schema-design-aws.md § services[]: aws_service, aws_config (secret names — never
values, KMS key usage, ACM domain), confidence: "inferred",
rubric_applied: "identity.md", and a rationale naming which criterion fired.
Every skipped role assignment emits skipped_config_source whose detail names the
identity_grant edge it produced.
Thin on purpose. Vaults and managed identities are fast-path rows; this file carries the
secret-versus-key-versus-certificate split, the RBAC refusal and its reasoning, and the
namespace_routing landing zone for Microsoft.KeyVault/* and
Microsoft.ManagedIdentity/* types with no row.