Skip to content
ECZ-IDService & Workload
Free Passport: Get a FREE Service & Workload Passport

Linking

Workload Identity Federation

One logical service usually runs under several workload identities at once — one per cloud, per cluster, per environment. Federation records that they belong to the same enduring service, and does nothing else.

What it does

It records that these are the same service

The relationship between a public identity and the internal identities a service runs under is, today, held in somebody's head or in a naming convention.

  • One service, several runtimes

    A workload identity in each cloud, a service account in each cluster, a SPIFFE identity per environment — declared as links against one ECZ-ID.

  • Continuity across a migration

    Moving a service between providers changes which links are active. It does not change the identity, and a counterparty sees continuity rather than a disappearance.

  • A readable answer outside the boundary

    A counterparty with no access to any of your infrastructure can still reach one record that names the service and the organisation operating it.

  • A declared pipeline

    Where a CI provider's OIDC identity publishes or deploys the service, that can be linked too — as a declared link, never published and never shown as verified.

What gets linked to one ECZ-ID — the shapes, not your values
SPIFFE / SPIRE
spiffe://<trust-domain>/<workload-path>
Kubernetes
A service account in a namespace, per cluster
Microsoft Entra
A managed identity or a federated workload identity
AWS
An IAM role the workload assumes
Google Cloud
A service account, directly or through workload identity federation
CI / CD
The OIDC identity a pipeline deploys the service with

Illustrative shapes. The values you link stay in your private estate; none is published on the Resolver. Providers and projects are named only to describe what their identity systems do. No partnership, endorsement, certified integration or joint product is implied.

The objection, answered directly

It takes no control of anything

A binding shows that a relationship has been declared. It does not grant, prove or imply authority to act.
  • It never replaces or controls your cloud IAM, SPIFFE identities or service accounts. Those stay exactly where they are, governed exactly as they are.
  • Nothing is issued. No credential, no certificate, no token and no trust relationship is created in your cloud by recording a link.
  • It is not in the execution path. No workload calls this to start, to scale or to serve a request, and an outage here does not reach your service.
  • It grants no access. A link is a declaration that a relationship exists, not a permission to do anything.
  • No cloud account identifier is published. The link records a relationship, not a copy of your configuration.
  • An ECZ-ID Passport is never a cloud runtime credential. No workload authenticates with it, holding one grants no access to anything, and your provider-native identities keep doing exactly what they do.

Optional

Workload Identity Federation

Links the ECZ-IDs of your logical services to the workload identities they already run under.

The boundary

It never replaces or controls your cloud IAM, SPIFFE identities or service accounts.

Nothing here is required to hold a free Service & Workload Passport, to publish its record or to have it resolved. Federation is useful when one service genuinely spans several providers; a single service in a single cloud needs one Passport and nothing else.

Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.

Federation tiers and workload services, from TrustOps

Read from the TrustOps projection generated 2026-10-14. Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.

Workload Identity Federation (monthly)

Paid · Open

£99.99 per month

Workload Identity Federation: up to 100 logical workloads — a federation register for your Service & Workload Passports; each workload mapped to its OIDC issuer and subject (GitHub Actions, Google Cloud, Microsoft Entra ID, Kubernetes) or SPIFFE ID; observation of each issuer's signing keys every 6 hours, with rotations recorded; a token-resolution API: a workload's OIDC token or JWT-SVID is checked against its own registered issuer's published keys and the audience it must carry, and answered with the workload's ECZ-ID. Delivered in the Estate Operations console. Not included: authorisation decisions (an answer is identity resolution only); verification of declared-only mappings such as an AWS IAM role ARN, which are shown as declared and unverified.

logical workloads
100 logical workloads
Choose Workload Identity Federation(opens in a new tab — trustops.ecocitizenz.com)

Workload Identity Federation (annual)

Paid · Open

£999 per year

  • One payment for 12 months (annual prepaid; it does not renew)

Workload Identity Federation: up to 100 logical workloads — a federation register for your Service & Workload Passports; each workload mapped to its OIDC issuer and subject (GitHub Actions, Google Cloud, Microsoft Entra ID, Kubernetes) or SPIFFE ID; observation of each issuer's signing keys every 6 hours, with rotations recorded; a token-resolution API: a workload's OIDC token or JWT-SVID is checked against its own registered issuer's published keys and the audience it must carry, and answered with the workload's ECZ-ID. Delivered in the Estate Operations console. Not included: authorisation decisions (an answer is identity resolution only); verification of declared-only mappings such as an AWS IAM role ARN, which are shown as declared and unverified. One payment for exactly 12 months. It does not renew.

logical workloads
100 logical workloads
Buy annual(opens in a new tab — trustops.ecocitizenz.com)

Workload Identity Federation Business (monthly)

Paid · Open

£299.99 per month

Workload Identity Federation Business: up to 500 logical workloads — a federation register for your Service & Workload Passports; each workload mapped to its OIDC issuer and subject (GitHub Actions, Google Cloud, Microsoft Entra ID, Kubernetes) or SPIFFE ID; observation of each issuer's signing keys every 6 hours, with rotations recorded; a token-resolution API: a workload's OIDC token or JWT-SVID is checked against its own registered issuer's published keys and the audience it must carry, and answered with the workload's ECZ-ID. Delivered in the Estate Operations console. Not included: authorisation decisions (an answer is identity resolution only); verification of declared-only mappings such as an AWS IAM role ARN, which are shown as declared and unverified.

logical workloads
500 logical workloads
Choose Workload Identity Federation Business(opens in a new tab — trustops.ecocitizenz.com)

Workload Identity Federation Business (annual)

Paid · Open

£2999 per year

  • One payment for 12 months (annual prepaid; it does not renew)

Workload Identity Federation Business: up to 500 logical workloads — a federation register for your Service & Workload Passports; each workload mapped to its OIDC issuer and subject (GitHub Actions, Google Cloud, Microsoft Entra ID, Kubernetes) or SPIFFE ID; observation of each issuer's signing keys every 6 hours, with rotations recorded; a token-resolution API: a workload's OIDC token or JWT-SVID is checked against its own registered issuer's published keys and the audience it must carry, and answered with the workload's ECZ-ID. Delivered in the Estate Operations console. Not included: authorisation decisions (an answer is identity resolution only); verification of declared-only mappings such as an AWS IAM role ARN, which are shown as declared and unverified. One payment for exactly 12 months. It does not renew.

logical workloads
500 logical workloads
Buy annual(opens in a new tab — trustops.ecocitizenz.com)

Go deeper

Where the argument continues

Where next

Keep going with ECZ-ID Service & Workload.

Get a FREE Service & Workload Passport