--- title: Teleport Workload Identity | daily.dev description: Teleport 15.2 introduces a preview of Teleport Workload Identity, which extends Teleport Machine ID to bootstrap and issue SPIFFE-based identities (SVIDs) to... canonical: https://daily.dev/posts/teleport-workload-identity-pihge4vhy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Teleport Workload Identity | daily.dev og:description: Teleport 15.2 introduces a preview of Teleport Workload Identity, which extends Teleport Machine ID to bootstrap and issue SPIFFE-based identities (SVIDs) to... og:url: https://daily.dev/posts/teleport-workload-identity-pihge4vhy og:image: https://api.daily.dev/og/posts/PIhGE4Vhy.png og:image:alt: Teleport Workload Identity og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Teleport Workload Identity **[Teleport](https://daily.dev/sources/teleport)** · 6 min read · 0 upvotes · 0 comments ## Summary Teleport 15.2 introduces a preview of Teleport Workload Identity, which extends Teleport Machine ID to bootstrap and issue SPIFFE-based identities (SVIDs) to services across clouds and organizational boundaries. It adds a SPIFFE workload API endpoint, TPM server attestation, and support for AWS Roles Anywhere, letting teams secure microservice-to-microservice communication with mTLS and X509 SVIDs, replace long-term AWS credentials, and centralize machine identity management alongside human access in one platform. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Teleport Workload Identity and how does it relate to SPIFFE? Teleport Workload Identity is a preview feature added in Teleport 15.2 that extends Teleport Machine ID to bootstrap and issue SPIFFE-based identities (SVIDs) to services across heterogeneous environments and organizational boundaries. It implements the SPIFFE standard, similar to SPIRE, adding a SPIFFE workload API endpoint, TPM server attestation, and AWS Roles Anywhere support for securing workloads across clouds. _Explore how daily.dev surfaces workload identity and zero-trust infrastructure developments as they ship._ ### How does Teleport Workload Identity work with AWS Roles Anywhere to avoid long-term credentials? Teleport Workload Identity acts as a trust anchor for AWS Roles Anywhere by providing Teleport's Certificate Authority as the CA, letting non-AWS services connect to AWS resources without long-term credentials. This setup also saves roughly $400 per month compared to running AWS Private CA, while enabling easier RBAC through SVID-based subjects on the Roles Anywhere role. _Teams weighing AWS credential strategies can track infrastructure identity approaches like this on daily.dev._ ### Which SPIFFE client libraries work with Teleport Workload Identity's SPIFFE workload API? Teleport Workload Identity is compatible with widely adopted SPIFFE libraries including go-spiffe, java-spiffe, python-spiffe, and node-spiffe. The tbot agent stores SVIDs on the filesystem and serves them through the SPIFFE workload API over a Unix socket, so applications in these languages can consume TLS certs to secure endpoints. _Developers integrating SPIFFE across language stacks can follow these ecosystem updates via daily.dev._ ## Similar posts on daily.dev - [Workload And Agentic Identity at Scale: Insights From CyberArk's Workload Identity Day Zero](https://daily.dev/posts/workload-and-agentic-identity-at-scale-insights-from-cyberark-s-workload-identity-day-zero-xyj2rtiw5) · GitGuardian · 0 upvotes · 0 comments - [Escaping Secrets Hell: How Workload Identity Scales Where Secrets Can’t](https://daily.dev/posts/escaping-secrets-hell-how-workload-identity-scales-where-secrets-can-t-qscclkce7) · Security Boulevard · 1 upvotes · 0 comments - [Zero trust observability: Integrating OpenTelemetry with workload identity manager](https://daily.dev/posts/zero-trust-observability-integrating-opentelemetry-with-workload-identity-manager-vk50fxrme) · Red Hat Developer · 0 upvotes · 0 comments - [What Is SPIFFE and How Does It Work?](https://daily.dev/posts/what-is-spiffe-and-how-does-it-work--cfg6ilipr) · Descope · 0 upvotes · 0 comments - [AI Overload: How to Solve the Workload Identity Crisis](https://daily.dev/posts/ai-overload-how-to-solve-the-workload-identity-crisis-s0rswqshu) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws) [View this post on daily.dev](https://daily.dev/posts/teleport-workload-identity-pihge4vhy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Teleport Workload Identity","url":"https://daily.dev/posts/teleport-workload-identity-pihge4vhy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/teleport-workload-identity-pihge4vhy"},"datePublished":"2026-08-23T12:22:56.177Z","dateModified":"2026-08-23T12:51:40.038Z","description":"Teleport 15.2 introduces a preview of Teleport Workload Identity, which extends Teleport Machine ID to bootstrap and issue SPIFFE-based identities (SVIDs) to...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/teleport-workload-identity-pihge4vhy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Teleport Workload Identity"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/teleport-workload-identity-pihge4vhy#faq","mainEntity":[{"@type":"Question","name":"What is Teleport Workload Identity and how does it relate to SPIFFE?","acceptedAnswer":{"@type":"Answer","text":"Teleport Workload Identity is a preview feature added in Teleport 15.2 that extends Teleport Machine ID to bootstrap and issue SPIFFE-based identities (SVIDs) to services across heterogeneous environments and organizational boundaries. It implements the SPIFFE standard, similar to SPIRE, adding a SPIFFE workload API endpoint, TPM server attestation, and AWS Roles Anywhere support for securing workloads across clouds. Explore how daily.dev surfaces workload identity and zero-trust infrastructure developments as they ship."}},{"@type":"Question","name":"How does Teleport Workload Identity work with AWS Roles Anywhere to avoid long-term credentials?","acceptedAnswer":{"@type":"Answer","text":"Teleport Workload Identity acts as a trust anchor for AWS Roles Anywhere by providing Teleport's Certificate Authority as the CA, letting non-AWS services connect to AWS resources without long-term credentials. This setup also saves roughly $400 per month compared to running AWS Private CA, while enabling easier RBAC through SVID-based subjects on the Roles Anywhere role. Teams weighing AWS credential strategies can track infrastructure identity approaches like this on daily.dev."}},{"@type":"Question","name":"Which SPIFFE client libraries work with Teleport Workload Identity's SPIFFE workload API?","acceptedAnswer":{"@type":"Answer","text":"Teleport Workload Identity is compatible with widely adopted SPIFFE libraries including go-spiffe, java-spiffe, python-spiffe, and node-spiffe. The tbot agent stores SVIDs on the filesystem and serves them through the SPIFFE workload API over a Unix socket, so applications in these languages can consume TLS certs to secure endpoints. Developers integrating SPIFFE across language stacks can follow these ecosystem updates via daily.dev."}}]} ```