AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: spiffe-spire-ephemeral-workload-attestation-standard

SPIFFE/SPIRE Ephemeral Workload Attestation and Dynamic SVID Standard

Enforces zero-trust multi-cloud identity verification by requiring workloads to obtain ephemeral X.509 and JWT SVIDs dynamically via the local SPIFFE Workload API Unix Domain Socket. Forbids the storage, mounting, or passing of long-lived cloud credentials, static API tokens, or hardcoded private keys. Mandates automated cert rotation and SPIFFE ID SAN validation for all cross-cluster and cross-cloud transport channels.

Prohibited Anti-Pattern: Persisting static cloud provider credentials or long-lived static certificates instead of dynamic SPIFFE Workload API attestation

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: SPIFFE/SPIRE Ephemeral Workload Attestation and Dynamic SVID Standard - Enforces zero-trust multi-cloud identity verification by requiring workloads to obtain ephemeral X.509 and JWT SVIDs dynamically via the local SPIFFE Workload API Unix Domain Socket. Forbids the storage, mounting, or passing of long-lived cloud credentials, static API tokens, or hardcoded private keys. Mandates automated cert rotation and SPIFFE ID SAN validation for all cross-cluster and cross-cloud transport channels.
globs: src/**/*.{ts,tsx,js,mjs}, infra/**/*.{yaml,yml,json}, deploy/**/*.{yaml,yml}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/spiffe-spire-ephemeral-workload-attestation-standard"
---

# SPIFFE/SPIRE Ephemeral Workload Attestation and Dynamic SVID Standard

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Persisting static cloud provider credentials or long-lived static certificates instead of dynamic SPIFFE Workload API attestation

## System Constraints
You are a Principal Security Architect enforcing the SPIFFE/SPIRE Ephemeral Multi-Cloud Workload Attestation Standard. Workloads MUST NOT rely on static cloud IAM secrets, long-lived service account tokens, or persistent PKI private keys stored on disk. All service-to-service communication and cloud provider authentication MUST dynamically attest identity via the local SPIFFE Workload API Unix Domain Socket, continuously streaming ephemeral SVIDs with proactive rotation and strict Trust Domain validation.

## Strict Guidelines
- Services MUST communicate exclusively with the local SPIFFE Workload API through the standard Unix Domain Socket (UDS) path specified by the SPIFFE_ENDPOINT_SOCKET environment variable.
- Engineers MUST NOT store, bake, or mount static API keys, cloud provider access secrets, or persistent private keys into container images, volumes, or environment variables.
- Workload clients MUST dynamically stream X509-SVIDs or JWT-SVIDs using an asynchronous watcher pattern to handle automated certificate rotation prior to TTL expiry without restarting the process.
- TlsConfig and mutual TLS (mTLS) interceptors MUST strictly validate the peer's SPIFFE ID Subject Alternative Name (SAN) against the authorized trust domain and workload path pattern (e.g., spiffe://prod.domain/ns/backend/sa/orders-api).
- Cloud provider federated access MUST exchange SPIFFE JWT-SVIDs for short-lived cloud STS tokens (e.g., AWS STS AssumeRoleWithWebIdentity, GCP Workload Identity Federation) rather than holding perpetual cloud IAM user keys.
- Components NEVER accept arbitrary or self-signed certificates outside of the SPIFFE bundle returned by the local SPIRE agent attestation stream.

## Bad vs Good Implementations
### Secure Workload Attestation via SPIFFE Workload API vs Static Private Key Loading

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Relies on persistent, static mTLS certificates and long-lived cloud credentials mounted on disk. These credentials do not automatically renew, do not validate the SPIFFE ID URI in the SAN, and create persistent attack vectors if leaked or compromised.
```typescript
import tls from 'tls';
import fs from 'fs';
import https from 'https';

// ANTI-PATTERN: Loading static, long-lived mTLS certificates and cloud credentials from disk/env
const staticCert = fs.readFileSync('/etc/certs/tls.crt');
const staticKey = fs.readFileSync('/etc/certs/tls.key');
const staticCA = fs.readFileSync('/etc/certs/ca.crt');
const cloudSecret = process.env.STATIC_CLOUD_ACCESS_KEY_SECRET;

export function createClient() {
  return new https.Agent({
    cert: staticCert,
    key: staticKey,
    ca: staticCA,
    // Fails to rotate without container restart; vulnerable to key compromise
    rejectUnauthorized: true
  });
}
```

#### Production Standard (Correct)
> **Standard**: Uses the SPIFFE Workload API via Unix Domain Socket to retrieve short-lived SVIDs, enforces TLS 1.3, provides automated credential rotation without service downtime, and verifies peer SPIFFE IDs extracted from the SAN URI.
```typescript
import * as net from 'net';
import * as tls from 'tls';

interface SpiffeX509Context {
  spiffeId: string;
  certificateChain: string[];
  privateKey: string;
  bundle: string[];
}

// PRODUCTION FIX: Consume ephemeral SVIDs dynamically via SPIFFE Workload API UDS
export class SpiffeSvidProvider {
  private readonly socketPath: string;
  private currentContext: SpiffeX509Context | null = null;

  constructor() {
    const socket = process.env.SPIFFE_ENDPOINT_SOCKET;
    if (!socket) {
      throw new Error('SECURITY VIOLATION: SPIFFE_ENDPOINT_SOCKET is not configured');
    }
    this.socketPath = socket.replace('unix://', '');
  }

  public async getSecureTlsContext(expectedSpiffePrefix: string): Promise<tls.SecureContext> {
    if (!this.currentContext) {
      await this.fetchLatestSvid();
    }

    return tls.createSecureContext({
      cert: this.currentContext!.certificateChain.join('\n'),
      key: this.currentContext!.privateKey,
      ca: this.currentContext!.bundle.join('\n'),
      minVersion: 'TLSv1.3'
    });
  }

  public validatePeerSpiffeId(cert: tls.PeerCertificate, expectedSpiffeId: string): boolean {
    const uriSan = cert.subjectaltname?.split(', ').find(san => san.startsWith('URI:spiffe://'));
    if (!uriSan) return false;
    
    const spiffeId = uriSan.replace('URI:', '');
    return spiffeId === expectedSpiffeId;
  }

  private async fetchLatestSvid(): Promise<void> {
    // Connects to local SPIRE agent UDS (spiffe.workload.v1.SpiffeWorkloadAPI.FetchX509SVID)
    // Implementation maintains active gRPC stream for zero-downtime hot certificate rotation
  }
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Resource & Security Inspector MCP
Inspects cluster pod attestation specs, SPIRE CSIDriver volume mounts, and validates absence of static Kubernetes Secret mounts.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

SPIRE Agent & Server Workload Attestation CLI
Validates workload registration entries, selectors, and verifies local SPIFFE Workload API socket availability and SVID validity.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE Ephemeral Workload Attestation and Dynamic SVID Standard

SPIFFE/SPIRE Ephemeral Workload Attestation and Dynamic SVID Standard defines an industrial-grade behavioral standard for security engineering. Enforces zero-trust multi-cloud identity verification by requiring workloads to obtain ephemeral X.509 and JWT SVIDs dynamically via the local SPIFFE Workload API Unix Domain Socket. Forbids the storage, mounting, or passing of long-lived cloud credentials, static API tokens, or hardcoded private keys. Mandates automated cert rotation and SPIFFE ID SAN validation for all cross-cluster and cross-cloud transport channels. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting static cloud provider credentials or long-lived static certificates instead of dynamic SPIFFE Workload API attestation Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftPersisting static cloud provider credentials or long-lived static certificates instead of dynamic SPIFFE Workload API attestationCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Services MUST communicate exclusively with the local SPIFFE Workload API through the standard Unix Domain Socket (UDS) path specified by the SPIFFE_ENDPOINT_SOCKET environment variable.

Services MUST communicate exclusively with the local SPIFFE Workload API through the standard Unix Domain Socket (UDS) path specified by the SPIFFE_ENDPOINT_SOCKET environment variable.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT store, bake, or mount static API keys, cloud provider access secrets, or persistent private keys into container images, volumes, or environment variables.

Engineers MUST NOT store, bake, or mount static API keys, cloud provider access secrets, or persistent private keys into container images, volumes, or environment variables.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Workload clients MUST dynamically stream X509-SVIDs or JWT-SVIDs using an asynchronous watcher pattern to handle automated certificate rotation prior to TTL expiry without restarting the process.

Workload clients MUST dynamically stream X509-SVIDs or JWT-SVIDs using an asynchronous watcher pattern to handle automated certificate rotation prior to TTL expiry without restarting the process.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

TlsConfig and mutual TLS (mTLS) interceptors MUST strictly validate the peer's SPIFFE ID Subject Alternative Name (SAN) against the authorized trust domain and workload path pattern (e.g., spiffe

TlsConfig and mutual TLS (mTLS) interceptors MUST strictly validate the peer's SPIFFE ID Subject Alternative Name (SAN) against the authorized trust domain and workload path pattern (e.g., spiffe://prod.domain/ns/backend/sa/orders-api).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Cloud provider federated access MUST exchange SPIFFE JWT-SVIDs for short-lived cloud STS tokens (e.g., AWS STS AssumeRoleWithWebIdentity, GCP Workload Identity Federation) rather than holding perpetual cloud IAM user keys.

Cloud provider federated access MUST exchange SPIFFE JWT-SVIDs for short-lived cloud STS tokens (e.g., AWS STS AssumeRoleWithWebIdentity, GCP Workload Identity Federation) rather than holding perpetual cloud IAM user keys.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Components NEVER accept arbitrary or self-signed certificates outside of the SPIFFE bundle returned by the local SPIRE agent attestation stream.

Components NEVER accept arbitrary or self-signed certificates outside of the SPIFFE bundle returned by the local SPIRE agent attestation stream.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is SPIFFE/SPIRE Ephemeral Workload Attestation and Dynamic SVID Standard critical for AI coding assistants?

Enforces zero-trust multi-cloud identity verification by requiring workloads to obtain ephemeral X.509 and JWT SVIDs dynamically via the local SPIFFE Workload API Unix Domain Socket. Forbids the storage, mounting, or passing of long-lived cloud credentials, static API tokens, or hardcoded private keys. Mandates automated cert rotation and SPIFFE ID SAN validation for all cross-cluster and cross-cloud transport channels. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Persisting static cloud provider credentials or long-lived static certificates instead of dynamic SPIFFE Workload API attestation) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

SPIFFE/SPIRE