manage-service-accounts

name	manage-service-accounts
category	code
description	Manage nonhuman identities through explicit ownership, least privilege, short-lived credentials, review, and retirement. Use when applications, automations, or infrastructure need machine-to-machine access.

manage-service-accounts

Give every machine identity one attributable purpose, bounded authority, and a tested end-of-life path.

Procedure

1. Inventory each service account, workload, environment, owner, approver, dependency, and current use.
2. Use a dedicated nonhuman identity rather than a shared human account.
3. Grant the smallest resource, action, environment, network, and time scope that performs the workload.
4. Prefer workload identity or short-lived federation over stored static secrets.
5. Store unavoidable credentials in a managed secret system and never in source, images, tickets, or chat.
6. Define issuance, rotation, overlap, revocation, break-glass, and dependency-recovery procedures.
7. Log authentication and consequential actions with the service, workload, and deployment identity.
8. Review privilege, activity, ownership, and unused accounts on a risk-based schedule.
9. Disable orphaned or dormant accounts through a staged process with rollback.
10. Test credential expiry, rotation, revoked access, owner absence, and workload recovery.

Guardrails

• Never exempt service accounts from MFA-equivalent workload assurance merely because no person logs in.
• A human owner must remain accountable even when credentials rotate automatically.
• Do not reuse one identity across development, staging, and production.

Done

• A service-account inventory report records purpose, owner, scope, credential type, and review date
• Rotation, revocation, expiry, and recovery tests are verified
• Active credentials and observed use reconcile with approved accounts and workloads