Return-Path: X-Original-To: wimse@ietfa.amsl.com Delivered-To: wimse@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0B6BC14F6E2 for ; Wed, 10 Jul 2024 14:09:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.55 X-Spam-Level: X-Spam-Status: No, score=-4.55 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.148, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, UNPARSEABLE_RELAY=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L-ThX8sfhqQU for ; Wed, 10 Jul 2024 14:09:47 -0700 (PDT) Received: from smtp-fw-80007.amazon.com (smtp-fw-80007.amazon.com [99.78.197.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D80CAC14F6E1 for ; Wed, 10 Jul 2024 14:09:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1720645788; x=1752181788; h=from:to:cc:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version:subject; bh=KQL41NhNYp3kMl4m0BVtWv1+KIB08YbZAkfTWHO88n0=; b=pCtr85e0ZNRiUo+MzwGbZZcvxVfde6IEXhRVMUFOHpnNGI3fQu+/NbTQ GS3Hl50JoNbV/NzB6y1PvnqOZwCujq8W68GMfi9n0N0gWHbaN0K+/BDkx XRBYHTfRZXZM/6qIGaWAHHea4w4tGCpBmJbRnWdSHS/lJPNPaAEn94Wsm 8=; X-IronPort-AV: E=Sophos;i="6.09,198,1716249600"; d="scan'208";a="310705112" Thread-Topic: [Wimse] Re: Request for Agenda Item: Workload identity authenticator levels Received: from pdx4-co-svc-p1-lb2-vlan2.amazon.com (HELO smtpout.prod.us-west-2.prod.farcaster.email.amazon.dev) ([10.25.36.210]) by smtp-border-fw-80007.pdx80.corp.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Jul 2024 21:09:47 +0000 Received: from EX19MTAUWC002.ant.amazon.com [10.0.7.35:2953] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.36.52:2525] with esmtp (Farcaster) id 539dd16f-f2f0-4ae8-80b9-37c0611ae887; Wed, 10 Jul 2024 21:09:47 +0000 (UTC) X-Farcaster-Flow-ID: 539dd16f-f2f0-4ae8-80b9-37c0611ae887 Received: from EX19D003UWC002.ant.amazon.com (10.13.138.169) by EX19MTAUWC002.ant.amazon.com (10.250.64.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1258.34; Wed, 10 Jul 2024 21:09:37 +0000 Received: from EX19D003UWC004.ant.amazon.com (10.13.138.150) by EX19D003UWC002.ant.amazon.com (10.13.138.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1258.34; Wed, 10 Jul 2024 21:09:37 +0000 Received: from EX19D003UWC004.ant.amazon.com ([fe80::38e:f9f6:c9f7:63fa]) by EX19D003UWC004.ant.amazon.com ([fe80::38e:f9f6:c9f7:63fa%4]) with mapi id 15.02.1258.034; Wed, 10 Jul 2024 21:09:37 +0000 From: "Saxe, Dean" To: Watson Ladd , Pieter Kasselman Thread-Index: AQHa0eYk5CZODXdwnEKT5iItngKqv7HuqLAAgAAD5oCAAA4VgIABRx8A Date: Wed, 10 Jul 2024 21:09:37 +0000 Message-ID: References: <26349E6F-7DFA-447D-977C-5E1C6E5E1F0D@amazon.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.86.24062313 x-originating-ip: [10.187.171.53] Content-Type: text/plain; charset="utf-8" Content-ID: <4D250A34F890CD48909875B73CAB1786@amazon.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Message-ID-Hash: 26XWHJOA6U7YQEW2INUVCUDPH3CUZD5K X-Message-ID-Hash: 26XWHJOA6U7YQEW2INUVCUDPH3CUZD5K X-MailFrom: prvs=914a09735=deansaxe@amazon.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: "wimse@ietf.org" X-Mailman-Version: 3.3.9rc4 Precedence: list Subject: =?utf-8?q?=5BWimse=5D_Re=3A_Request_for_Agenda_Item=3A_Workload_identity_aut?= =?utf-8?q?henticator_levels?= List-Id: WIMSE Workload Identity in Multi-Service Environment Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: V2F0c29uLA0KDQpJIHRoaW5rIGl0J3MgbW9yZSBjaGFsbGVuZ2luZyB0aGFuIHNpbXBseSBtYWtp bmcgYSBwaXRoeSBzdGF0ZW1lbnQgYWJvdXQgc2hhcmVkIHNlY3JldHMsIGV2ZW4gaWYgSSBhZ3Jl ZSB3aXRoIHRoZSBzdGF0ZW1lbnQhICANCg0KSW4gbWFueSBjYXNlcywgd29ya2xvYWRzIG9wZXJh dGUgb24gYmVoYWxmIG9mIHVzZXJzLiAgVGhlcmUgaXMgYSBuZWVkIHRvIHByb3BhZ2F0ZSBwcm9w ZXJ0aWVzIG9mIHRoZSBhdXRoZW50aWNhdGlvbiBldmVudChzKSB0byBkb3duc3RyZWFtIHN5c3Rl bXMgc28gdGhleSBtYXkgYmUgdXNlZCBhcyBwYXJ0IG9mIGFuIGF1dGhvcml6YXRpb24gcG9saWN5 Lg0KDQpUbyB1c2UgYSBGSURPIHNwZWNpZmljIGV4YW1wbGUsIHR3byB1c2VycyBjYW4gYm90aCBh dXRoZW50aWNhdGUgd2l0aCBhIEZJRE8tYmFzZWQgY3JlZGVudGlhbCBzdWNoIGFzIGEgcGFzc2tl eS4gIE9uZSB1c2VyIHVzZXMgYSBwYXNza2V5IHRoYXQgaXMgc3luY2VkIGFjcm9zcyBhIGZhYnJp YyAoZS5nLiBEYXNobGFuZSwgMVBhc3N3b3JkLCBpQ2xvdWQsIGV0Yy4pLCBwb3RlbnRpYWxseSB0 byBtYW55IGRldmljZXMgd2l0aCBkaWZmZXJlbnQsIHVua25vd24gc2VjdXJpdHkgcG9zdHVyZXMu ICBUaGUgb3RoZXIgdXNlcyBhIHBhc3NrZXkgYm91bmQgdG8gYSBoYXJkd2FyZSBkZXZpY2UgbGlr ZSBhIFl1YmlrZXkuICAgIEJvdGggYXJlIHVzaW5nIGNyZWRlbnRpYWxzIHRoYXQgYXJlIGhpZ2hs eSBwaGlzaGluZyByZXNpc3RhbnQgYW5kIG5vdCBzaGFyZWQgc2VjcmV0cyAoeWF5ISkuICBCdXQg dGhlc2UgY3JlZGVudGlhbHMgaGF2ZSBmdW5kYW1lbnRhbGx5IGRpZmZlcmVudCBwcm9wZXJ0aWVz IHdoZW4gd2UgY29uc2lkZXIgdGhlaXIgc3RvcmFnZSwgc2hhcmVhYmlsaXR5LCBhbmQgcmVjb3Zl cmFiaWxpdHkuICBUaGV5IGFyZSBub3QgZXF1YWwgaW4gdGVybXMgb2YgdGhlaXIgaW5oZXJlbnQg cHJvcGVydGllcy4NCg0KV2hpbGUgdGhpcyBkaWZmZXJlbmNlIG1heSBub3QgYmUgaW1wYWN0ZnVs IGZvciBhbGwgd29ya2xvYWRzLCB0aGVyZSBhcmUgd29ya2xvYWRzIHRoYXQgZG8gbmVlZCB0aGUg YWJpbGl0eSB0byBtYWtlIGF1dGhvcml6YXRpb24gZGVjaXNpb25zIGJhc2VkIHVwb24gdGhlIHBy b3BlcnRpZXMgb2YgdGhlIGF1dGhlbnRpY2F0aW9uIGV2ZW50KHMpLiAgTXkgZXhhbXBsZSBmb2N1 c2VkIG9uIGVuZC11c2VyIGF1dGhlbnRpY2F0aW9uLCBidXQgSSBiZWxpZXZlIHRoZSBzYW1lIHRv IGJlIHRydWUgZm9yIGEgd29ya2xvYWQtdG8td29ya2xvYWQgYXV0aGVudGljYXRpb24gZXZlbnQs IHRvby4NCg0KLWRocw0KDQotLSANCkRlYW4gSC4gU2F4ZSwgQ0lEUFJPIDxodHRwczovL2lkcHJv Lm9yZy9jaWRwcm8vPiAoaGUvaGltKSANClNlbmlvciBTZWN1cml0eSBFbmdpbmVlciwgQVdTIElk ZW50aXR5IFNlY3VyaXR5IFRlYW0gfCBBbWF6b24gV2ViIFNlcnZpY2VzIChBV1MpIA0KRTogZGVh bnNheGVAYW1hem9uLmNvbSA8bWFpbHRvOmRlYW5zYXhlQGFtYXpvbi5jb20+IHwgTTogMjA2LTY1 OS03MjkzIDx0ZWw6MjA2LTY1OS03MjkzPiANCg0KDQoNCg0K77u/T24gNy85LzI0LCAxMTozOSBB TSwgIldhdHNvbiBMYWRkIiA8d2F0c29uYmxhZGRAZ21haWwuY29tIDxtYWlsdG86d2F0c29uYmxh ZGRAZ21haWwuY29tPj4gd3JvdGU6DQoNCg0KQ0FVVElPTjogVGhpcyBlbWFpbCBvcmlnaW5hdGVk IGZyb20gb3V0c2lkZSBvZiB0aGUgb3JnYW5pemF0aW9uLiBEbyBub3QgY2xpY2sgbGlua3Mgb3Ig b3BlbiBhdHRhY2htZW50cyB1bmxlc3MgeW91IGNhbiBjb25maXJtIHRoZSBzZW5kZXIgYW5kIGtu b3cgdGhlIGNvbnRlbnQgaXMgc2FmZS4NCg0KDQoNCg0KDQoNCk9uIFR1ZSwgSnVsIDksIDIwMjQg YXQgMTA6NDggQU0gUGlldGVyIEthc3NlbG1hbg0KPHBpZXRlci5rYXNzZWxtYW5AbWljcm9zb2Z0 LmNvbSA8bWFpbHRvOnBpZXRlci5rYXNzZWxtYW5AbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0KPg0K PiBIaSBXYXRzb24NCj4NCj4gSXQncyBub3Qgc28gbXVjaCBhYm91dCB1c2UgY2FzZXMvanVzdGlm aWNhdGlvbiBmb3Igd2VhayBhdXRoZW50aWNhdGlvbiwgYnV0IGEgd2F5IHRvIGNsYXNzaWZ5IGl0 LCBhbmQgbW9yZSBpbXBvcnRhbnRseSBmb3IgcGVvcGxlIGRlZmluaW5nIHN5c3RlbXMgdG8gZGVm aW5lIHRoZSBsZXZlbCBvZiBhdXRoZW50aWNhdGlvbiB0aGV5IGRlc2lyZS4NCj4NCj4gSW4gYW4g aWRlYWwgd29ybGQsIHdlIHdpbGwgb25seSBoYXZlIHN0cm9uZyBjcnlwdG9ncmFwaGljIHRlY2hu aXF1ZXMgd2l0aCBoYXJkd2FyZSBwcm90ZWN0aW9uIGZvciBrZXlzIGFuZCBhdHRlc3RhdGlvbiBt ZWNoYW5pc21zIHRoYXQgYXJlIGZyZXF1ZW50bHkgYXBwbGllZCB0byBlbnN1cmUgYSB3b3JrbG9h ZHMgaWRlbnRpdHkuIFRoZSByZWFsaXR5IGlzIHRoYXQgYmVhcmVyIHRva2VucyBhbmQgc2hhcmVk IHNlY3JldHMgd2hlcmUgbm8gYXR0ZXN0YXRpb24gb2YgdGhlIHdvcmtsb2FkIGV2ZXIgdGFrZXMg cGxhY2UgZXhpc3RzLCBhbmQgd2l0aG91dCBhIHdheSB0byBjbGFzc2lmeSB0aGVzZSByZWxhdGl2 ZSB0byB0aGUgYmV0dGVyIHByYWN0aWNlcyAoc3Ryb25nIGNyeXB0bywgaGFyZHdhcmUsIGF0dGVz dGF0aW9uIGV0Yykgb25seSBzb3BoaXN0aWNhdGVkIGN1c3RvbWVycyB3aWxsIGJlIGFibGUgdG8g ZGlzY2VybiBzeXN0ZW1zLiBQdXQgYW5vdGhlciB3YXksIGl0IGlzIGhhcmQgdG8gYXZvaWQgc29t ZXRoaW5nIHRoYXQgaXMgaGFybWZ1bCwgaWYgeW91IGhhdmUgbm8gd2F5IHRvIHRlbGwgaWYgaXQg aXMgaGFybWZ1bCAob3IgYXQgbGVhc3Qgbm90IGNhbGlicmF0ZWQgdG8gdGhlIHJpc2tzIHlvdXIg d2lsbGluZyB0byB0YWtlKS4NCg0KDQpXZSBjYW4ganVzdCB3cml0ZSAiU2hhcmVkIFNlY3JldHMg Y29uc2lkZXJlZCBoYXJtZnVsIiBhbmQgaW4NCnBhcnRpY3VsYXIgcGFydCBvZiB3aGF0IHdlJ3Jl IGRvaW5nIGlzIHNheWluZyBpcyBob3cgdG8gZG8gdGhlIHNlcnZpY2UNCnRvIHNlcnZpY2Ugcmln aHQuIE5vIG5lZWQgZm9yIGEgaGVhdnl3ZWlnaHQgdGF4b25vbXkuIEknbSBhbHNvIHJlYWxseQ0K Y29uZnVzZWQgYnkgc2F5aW5nIHdlIG5lZWQgaGFyZHdhcmUgcHJvdGVjdGlvbiBhbmQgZnJlcXVl bnQNCmF0dGVzdGF0aW9uOiB0byBteSBtaW5kIHdvcmtsb2FkIGFwcHJveGltYXRlcyBzZXJ2aWNl IGluIEt1YmVybmV0ZXMNCmxhbmd1YWdlLCBhbmQgb25lIGRvZXNuJ3QgbmVlZCBhdHRlc3RhdGlv biAoYXR0ZXN0IHdoYXQgdG8gd2hvbT8pIGFzDQp0aGUgY29uc3RpdHVlbnRzIG9mIHRoZSBzZXJ2 aWNlIGFyZSBkZWZpbmVkIGJ5IHRoZSBzZXJ2aWNlIGRlZmluaXRpb24uDQpZb3UgdHJ1c3QgdGhl IGFkbWlzc2lvbiBzeXN0ZW0gKGJ1dCBJIG1pZ2h0IGJ5IHJ1c3R5IG9uIHRoZSBleGFjdA0KdGVy bXMpIHRvIGRlYWwgd2l0aCAid2hvIGdldHMgdG8gZGVmaW5lIHRoZSBzZXJ2aWNlIiwgd2hpY2gg SSB0aGluayBpcw0KbGFyZ2VseSBvcnRob2dvbmFsLg0KDQoNCk9uIHJlZmxlY3Rpb24gSSB0aGlu ayB0aGVyZSdzIGFuIHVuZGVybHlpbmcgZGlmZmVyZW5jZSBoZXJlIGluIHRlcm1zDQpvZiBob3cg YW5kIHdoZXJlIGFuZCB3aGF0IGtpbmRzIG9mIHBvbGljaWVzIGFyZSBiZWluZyBlbmZvcmNlZCwg YW5kIGl0DQptaWdodCBiZSB1c2VmdWwgdG8gaGF2ZSB0aGF0IGRpc2N1c3Npb24gZXhwbGljaXRs eS4NCg0KDQpTaW5jZXJlbHksDQpXYXRzb24NCj4NCj4gQ2hlZXJzDQo+DQo+IFBpZXRlciAoSWRl bnRpdHkgZW50aHVzaWFzdCkNCj4NCj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gRnJv bTogV2F0c29uIExhZGQgPHdhdHNvbmJsYWRkQGdtYWlsLmNvbSA8bWFpbHRvOndhdHNvbmJsYWRk QGdtYWlsLmNvbT4+DQo+IFNlbnQ6IFR1ZXNkYXksIEp1bHkgOSwgMjAyNCA2OjM0IFBNDQo+IFRv OiBQaWV0ZXIgS2Fzc2VsbWFuIDxwaWV0ZXIua2Fzc2VsbWFuQG1pY3Jvc29mdC5jb20gPG1haWx0 bzpwaWV0ZXIua2Fzc2VsbWFuQG1pY3Jvc29mdC5jb20+Pg0KPiBDYzogU2F4ZSwgRGVhbiA8ZGVh bnNheGVAYW1hem9uLmNvbSA8bWFpbHRvOmRlYW5zYXhlQGFtYXpvbi5jb20+Pjsgd2ltc2VAaWV0 Zi5vcmcgPG1haWx0bzp3aW1zZUBpZXRmLm9yZz4NCj4gU3ViamVjdDogUmU6IFtXaW1zZV0gUmU6 IFJlcXVlc3QgZm9yIEFnZW5kYSBJdGVtOiBXb3JrbG9hZCBpZGVudGl0eSBhdXRoZW50aWNhdG9y IGxldmVscw0KPg0KPiBJIGFtIHZlcnkgY29uZnVzZWQgYW5kIG5vdCBmb2xsb3dpbmcgdGhlIGNv bnZlcnNhdGlvbiBoZXJlLg0KPg0KPiBUaGUgb3JjaGVzdHJhdG9yIGRlZmluaXRpb25hbGx5IGF1 dGhlbnRpY2F0ZXMgd29ya2xvYWRzIGluIHRoZSBzYW1lIHdheSB0aGF0IGUuZy4gYSBQSUQgb24g YSBrZXJuZWwgaWRlbnRpZmllcyBhIHByb2Nlc3MuIE9uZSBjYW5ub3QgdGFsayBhYm91dCB0d28g UElEcyBiZWluZyB0aGUgc2FtZSBwcm9jZXNzICh5ZXMsIHllcyBsaW51eCB0aHJlYWRzLCBldGMu KSBvciB0d28gcHJvY2Vzc2VzIGhhdmluZyB0aGUgc2FtZSBQSUQgYXQgdGhlIHNhbWUgdGltZSwg YmVjYXVzZSB0aGUgcmVsZXZhbnQgZGF0YSBzdHJ1Y3R1cmVzIGFyZSBpbmRleGVkIGJ5IFBJRC4g Q29udmVyc2VseSBhYnNlbnQgdGhlIG9yY2hlc3RyYXRvciBiZWluZyB0cnVzdGVkIHRoZXJlJ3Mg bm8gd2F5IHRvIGtub3cgd2hhdCBhIHdvcmtsb2FkDQo+ICJpcyI6IGl0J3MganVzdCBzb21lIHBy b2Nlc3MgZXhlY3V0aW5nIG9uIGEgY29tcHV0ZSBlbnZpcm9ubWVudCB0aGF0IGlzbid0IHRydXN0 ZWQuDQo+DQo+IFdoZW4gaXQgY29tZXMgdG8gd29ya2xvYWQgQSBkaXJlY3RseSBhdXRoZW50aWNh dGluZyB0byB3b3JrbG9hZCBCLCB3aHkgbm90IHVzZSBzdHJvbmcgY3J5cHRvLCBwZXIgdHJhbnNh Y3Rpb24/IEFuZCBpZiB5b3UgaGF2ZSB0aGF0LCB3aHkgZG8geW91IG5lZWQgZGlmZmVyZW50aWF0 aW9uPyBJdCdzIGVhc3kgdG8gZG8gc2VydmljZSBhdXRoIHRoYXQncyBzdHJvbmchDQo+IFRoZXJl IG1pZ2h0IGJlIGlzc3VlcyB3aXRoIGNoYWluaW5nLCBidXQgdGhhdCdzIHdoYXQgdGhlIHN0YW5k YXJkcyBlZmZvcnQgaGVyZSBpcyB0byBzb2x2ZS4NCj4NCj4gVGhpcyBpcyBkaWZmZXJlbnQgZnJv bSBodW1hbiBhdXRoZW50aWNhdGlvbiBhcyBodW1hbnMgY2Fubm90IG11bHRpcGx5DQo+IDIwNDgg Yml0IG51bWJlcnMgaW4gdGhlaXIgaGVhZHMgYW5kIHRodXMgaGF2ZSB0byBtYWtlIGRvIHdpdGgg cGFzc3dvcmRzLCBzc2gga2V5cywgZXRjLiBlYWNoIHdpdGggdGhlaXIgb3duIGRyYXdiYWNrcyBh bmQgaGVuY2UgbmVlZCB0byB0YWxrIGFib3V0IGNvbmZpZGVuY2UgaW4gaHVtYW4gdG8gbWFjaGlu ZSAoYW5kIGh1bWFuIHRvIGh1bWFuOg0KPiBtZWRhbGxpb24gc2lnbmF0dXJlIGd1YXJlbnRlZXMg YXJlIGEgcmVhbCB0aGluZyEpIGF1dGhlbnRpY2F0aW9uLg0KPg0KPiBXaGF0J3MgdGhlIHVzZWNh c2UgZm9yIHdlYWsgYXV0aCBpbiBzZXJ2aWNlIHRvIHNlcnZpY2U/DQo+DQo+IFNpbmNlcmVseSwN Cj4gV2F0c29uIExhZGQNCg0KDQoNCg0KDQoNCi0tDQpBc3RyYSBtb3J0ZW1xdWUgcHJhZXN0YXJl IGdyYWRhdGltDQoNCg0KDQo=