Skip to content

Rotate & offboard

Credential rotation and clean removal, per cloud. Review every federated trust relationship at least every 12 months and rotate sooner after personnel, issuer, subject, or compromise events. Client-secret fallbacks retain their shorter 90-day maximum. All changes use terraform apply / terraform destroy plus a heads-up to Venturi.

Rotate

Recommended every 12 months.

  1. Schedule a short ingestion pause and ask Venturi for a new external_id.
  2. Update terraform.tfvars and run terraform apply. This replaces the single accepted value; it does not overlap old and new values.
  3. Venturi switches to the new value and you run ./scripts/verify.sh.
  4. Resume ingestion after the read probes pass; revert if they fail.

wif_allowed_subjects is a list, so rotate with no downtime:

  1. Ask Venturi for the new subject string.
  2. Add it (don’t replace yet) → terraform apply.
  3. Confirm Venturi is using the new subject and run ./scripts/verify.sh.
  4. Remove the old subject → terraform apply again.
  • Workload Identity Federation: add a second federated credential for the new explicit subject, confirm federation and run ./scripts/verify.sh, then remove the old credential. The current Terraform module models 1 credential, so overlap requires a temporary customer-managed credential resource.
  • Client-secret fallback: 90-day TTL by design. Create an overlapping new secret, transfer it through the approved encrypted channel, verify it, then revoke the old secret and apply the final Terraform state.

Offboard (remove access)

Bash
cd infra/<cloud>/onboarding
terraform destroy

This removes everything the module created:

Cloud Destroyed
AWS The IAM role and its policies
GCP The service account, the WIF pool/provider, and all IAM bindings
Azure The application, the service principal, and all role assignments

Notify Venturi first

Tell your onboarding contact before you destroy, so attribution ingestion is paused cleanly rather than failing mid-read. After destroy, Venturi loses visibility after cached or federated sessions expire. AWS role sessions can remain valid for up to 15 minutes; other providers follow their token TTLs.

Audit trail

Keep the granted_permissions / granted_roles output from your original terraform apply. It’s the human-readable record of exactly what was granted, and pairs with the module source for a security review.

After any rotation, run the cloud module’s ./scripts/verify.sh and retain its output with the Terraform plan and apply record.