5.2. Managing Service Accounts

💡 First Principle: A service account is an identity for a workload, not a person — which changes the entire security model around it: instead of a human remembering to log out or rotate a password, security here is about making sure applications can prove who they are without ever holding onto a long-lived, stealable secret.

A leaked human password is bad; a leaked, long-lived service account key is often worse, because it's frequently scoped broadly, rarely rotated, and easy to accidentally commit into a code repository where it can be found by anyone. Every practice in this section exists to reduce or eliminate that specific risk.

⚠️ Common Misconception: A service account is essentially a special kind of human user account. In reality, service accounts are identities for workloads and applications, not people — best practice authenticates them via short-lived credentials or Workload Identity Federation rather than long-lived downloaded keys.