Hi HN,
Most automation still runs with cloud credentials.
CI pipelines have AWS keys, containers receive service account tokens, scripts and AI agents get API credentials so they can call cloud APIs.
This creates a familiar set of problems:
- credentials leak through logs, repos, prompts, or memory
- they are difficult to rotate at scale
- once leaked, they often grant broad access
- security teams lose visibility over who actually called which API
Humans don’t access infrastructure this way anymore — we use identity-based access (SSO, short-lived sessions, policy enforcement).
But workloads and agents still receive raw credentials.
So I built Warden.
Warden is an identity-aware gateway for cloud APIs. Instead of distributing credentials to workloads, workloads authenticate with their identity, and Warden performs the cloud API calls on their behalf.
The model looks like this:
Workload → identity → Warden → cloud API
In practice:
1. A workload authenticates to Warden (mTLS, OIDC, workload identity, etc.)
2. It requests access to a cloud API
3. Warden evaluates policies
4. Warden signs the request and calls the cloud provider API
The workload never receives cloud credentials.
This makes it possible to:
• remove cloud credentials from CI pipelines
• prevent credentials from reaching AI agents or ephemeral compute
• enforce centralized policy on API calls
• maintain a full audit trail of every request
Some design goals:
• compatible with existing cloud APIs (including AWS SigV4)
• designed to scale horizontally
• identity-based access for humans, workloads, and agents
• strong auditing of every API call
The motivation came from seeing organizations trying to secure thousands of credentials instead of eliminating credential distribution entirely.
Happy to answer any technical questions and would love feedback from the HN community.
stephnangue•2h ago
This creates a familiar set of problems: - credentials leak through logs, repos, prompts, or memory - they are difficult to rotate at scale - once leaked, they often grant broad access - security teams lose visibility over who actually called which API
Humans don’t access infrastructure this way anymore — we use identity-based access (SSO, short-lived sessions, policy enforcement).
But workloads and agents still receive raw credentials. So I built Warden. Warden is an identity-aware gateway for cloud APIs. Instead of distributing credentials to workloads, workloads authenticate with their identity, and Warden performs the cloud API calls on their behalf.
The model looks like this: Workload → identity → Warden → cloud API
In practice: 1. A workload authenticates to Warden (mTLS, OIDC, workload identity, etc.) 2. It requests access to a cloud API 3. Warden evaluates policies 4. Warden signs the request and calls the cloud provider API
The workload never receives cloud credentials.
This makes it possible to: • remove cloud credentials from CI pipelines • prevent credentials from reaching AI agents or ephemeral compute • enforce centralized policy on API calls • maintain a full audit trail of every request
Some design goals: • compatible with existing cloud APIs (including AWS SigV4) • designed to scale horizontally • identity-based access for humans, workloads, and agents • strong auditing of every API call The motivation came from seeing organizations trying to secure thousands of credentials instead of eliminating credential distribution entirely.
Happy to answer any technical questions and would love feedback from the HN community.