DataTerminology.comNEW
Also known as: Service Principal
A non-human identity used by applications, services, or workloads to authenticate and access resources.
DESCRIPTION
Service accounts represent workloads rather than people, enabling applications and automated processes to authenticate and authorize securely. They often use short-lived credentials, keys, or federated tokens. Cloud platforms provide native service account constructs (e.g., GCP Service Accounts, Azure service principals, Kubernetes service accounts) and policy controls. Good practices include least privilege, key rotation, avoiding long-lived static secrets, and central auditing. Where available, managed identities reduce secret management overhead.
ALTERNATIVE DEFINITIONS
Google Cloud
A service account is a special kind of account used by an application or compute workload, not a person.
Clearly contrasts service accounts with human users in GCP.
Kubernetes
A service account provides an identity for processes that run in a Pod.
Defines service accounts in Kubernetes for in-cluster authentication.
Microsoft Learn
A service principal is an identity that is used by applications, hosted services, and automated tools to access Azure resources.
Describes the Azure equivalent identity for applications.
RELATED TERMS
Identity Management IAM Role API Key Secrets Management Workload Identity OAuth 2.0 RBAC Audit Logging Key Rotation
COMPETING TERMS
User Account Managed Identity
RELATIONS
- Broader: Account
KNOWLEDGE AREAS
Data Security Cloud Platform & Tooling Infrastructure
TARGET AUDIENCE
DevOps Engineer Cloud Architect Software Developer Data Engineer MLOps Engineer Chief Information Officer
EXTERNAL SOURCES
- Google Cloud - GCP service accounts overview
- Kubernetes - Kubernetes service accounts guide
- Microsoft - Azure service principals explained
TOP QUESTIONS
Why use Service Accounts instead of User Accounts for automation?
Service accounts provide identities tailored to workloads, enabling least privilege and auditable, non-human authentication without shared human credentials.
Category: Relevancy
What are best practices for Service Account security?
Use least privilege, rotate keys, prefer short-lived tokens or managed identities, and monitor usage with logs and alerts.
Category: Best practices
How do Service Accounts work in Kubernetes?
They provide Pods with identities to access the API server or external services, often via projected tokens and RBAC policies.
Category: Concept
What is a common mistake with Service Accounts?
Using long-lived static keys or overbroad permissions, increasing exposure in case of compromise.
Category: Mistakes
How do Service Accounts relate to IAM roles?
In clouds, service accounts can be bound to roles that grant permissions. Workload identity federation maps identities without static keys.
Category: Relation
What is a Managed Identity compared to a Service Account?
Managed identities are platform-managed service identities with automatic credential management, reducing secret handling.
Category: Alternatives
How should Service Accounts be monitored?
Enable audit logs, anomaly detection, and least-privilege reviews. Tag accounts with owners and purposes.
Category: Management
Can Service Accounts be used across multiple environments?
Yes, but scope them per environment or workload, and avoid sharing credentials across environments to limit blast radius.
Category: Practice
How do Service Accounts support compliance?
They create clear, non-human identities for automation, aid separation of duties, and simplify access reviews.
Category: Compliance