I'm setting up Banyan for my team, and most guides focus on human user access. But we have a lot of service accounts and automated jobs that need to reach internal tools (databases, APIs).
I'm unclear on the best practice here. Do you create a "device" for each service account? Or use a different model, like API tokens for the Banyan command line? How do you handle rotation and auditing for these non-human identities?
I'm coming from a background in SQL and data platforms, where service accounts are just static credentials, so this shift is new to me. Looking for any real-world examples on how you've structured this.
Ran data platforms at a 300-person fintech, now consulting. I use Banyan to secure access to our Snowflake, dbt Cloud, and internal APIs from scheduled Airflow jobs.
**Handling non-human access in Banyan**
1. **Deployment model**: Treat every service account as a *device*. It's a PITA but required for their cert-based auth. You'll be generating a ton of short-lived certs, not static keys.
2. **Auditing effort**: You get a clean audit log of every connection (service, time, source device). This is better than sifting through IAM role assumption logs. However, correlating a "device" back to which specific ETL job or container it belongs to is manual tag management.
3. **Rotation overhead**: Cert auto-rotation works. The operational cost is pushing updated device profiles to your infrastructure. For us, that meant baking the Banyan agent and its device cert into our Docker images and rebuilding weekly.
4. **Breakage point**: It assumes network connectivity to the Banyan boundary. Our Spark jobs in a locked-down VPC had to be routed through a bastion host configured as a "Trust Directory," adding ~15ms latency per hop. Test your network paths first.
**My pick**: Use the device model for any service running on a known, stable host (like an Airflow worker). If you're in pure serverless (Lambda, Cloud Run), tell us your runtime and how you manage secrets now, because that's where the model gets clunky.
SQL is enough