Configure workload roles

Workload roles define who can access resources in Okta Privileged Access and act as principals in security policies. These roles group multiple unique, ephemeral workloads into a single logical identity based on shared characteristics.

Before you begin

• You must have a security admin role.

• A workload connection must exist. See Configure workload connection.

• For JWT authentication: Review Principal SSH access for automated workloads.

• For API key authentication: An API key must have been generated for the workload connection. See Manage API keys.

• For AWS IAM authentication: The workload connection must be of type AWS IAM. See Configure workload connection.

Create a workload role

Complete the following steps to create a workload role.

1. On the Okta Privileged Access dashboard, go to Security Administration > Workload roles.

2. Enter a Name and Description.

3. Complete the workload role requirements:

   1. Select a workload connection

   2. Optional. Click Filter with additional conditions, and then enter a Source field name, select an Operator, and enter a Value.

      Note:

      For JWT authentication: Conditions filter on JWT claims. Okta recommends inspecting your JWT using a debug script or jwt.io.

      For API key authentication: Conditions filter on API key claims. These are the key-value pairs assigned when the API key was generated. See Manage API keys for details on setting claims.

      For AWS IAM authentication: Conditions filter on the AWS identity of the workload. When you select an AWS IAM workload connection, the Source field name, Operator, and Value fields are replaced by the same AWS identity settings that are available on the connection: Resource type, Resource name, Session info, Resource ID, and Region. Each setting you complete must match exactly. Select Parse from ARN to fill in some of these settings from an ARN. For descriptions of each setting, see Create an AWS IAM workload connection.

   3. Optional. Click Add a condition, and then repeat the preceding steps.

4. Optional. Click Add a requirement, and then repeat the preceding steps.

5. Click Save Workload role.

After creating the workload role, you must integrate it into the Okta Privileged Access policy engine to grant access to resources. Once the policy is published, the automated workload can execute the authentication and access sequence.

Verify workload access

After you create a workload role and add it to a security policy, verify that the workload can access the intended resources by running the sft CLI command to list servers.

1. Run the sft ls command from the workload with the appropriate authentication credentials:

   • For JWT authentication: Use the sft workload authenticate command. See CLI command for workload authentication.

   • For API key authentication: Use the sft workload authenticate command with the API key. See CLI command for workload authentication.

   • For AWS IAM authentication: Use the sft workload authenticate command with either the --aws flag or the --aws-profile <profile-name> flag. Use --aws-profile to authenticate with the credentials from a named AWS profile. See CLI command for workload authentication.

2. The command lists all servers that the workload role has access to based on the security policies in effect.