Stay organized with collections
Save and categorize content based on your preferences.
Identity reflection for federated workloads
You can use Certificate Authority Service with workload identity pools
and identity reflection to federate a third-party identity and obtain a certificate
that attests to this identity.
Identity reflection is a special certificate issuance mode that limits an
unprivileged certificate requester to requesting certificates with a subject
alternative name (SAN) corresponding to the identity in their credential. For
example, an Cloud Service Mesh
workload with a federated third-party identity token might be able to request a
certificate with a SAN corresponding to its Mesh identity, but cannot request a
certificate with any other SAN.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026年08月26日 UTC."],[],[]]