FaunaDB RBAC and External Identity Providers: Secret Key Rotation Logic
0 reputation · 30 Mar 2020, 08:14 UTC
Integrating FaunaDB Roles with External Credential Lifecycles
FaunaDB implements a granular Role-Based Access Control (RBAC) system where secret keys are mapped to specific roles to enforce least-privilege access. While roles can be modified in real-time to update permissions across all associated keys, the platform does not natively provide a time-to-live (TTL) or expiration timestamp for these secret keys.
When integrating FaunaDB into an architecture that requires short-lived credentials—such as those issued by an external identity provider or a secrets manager—the responsibility for key expiration and rotation falls on the external orchestrator.
There is uncertainty regarding the most efficient method to synchronize external credential expiration with FaunaDB's permanent key model without creating an excessive number of orphaned keys or roles.
- What is the recommended pattern for automating the revocation of specific secret keys when an external session expires?
- Does the API support a bulk-revocation mechanism for keys associated with a temporary session identity?
