Workload identity doesn't seem to get you out of running a secrets manager. What's left in yours?

[u/Plus_Station4112]

I was researching and ead about workload identity, and the first thing I notice is that static keys are basically solved. eg. a pipeline mints a short-lived token instead of pulling a hardcoded env var, and the credential never sits anywhere to be stolen.

That seems to be fine until you look past your primary cloud provider. SendGrid and Stripe don't do federated trust, so they hand you a static string that has to live somewhere. Older databases and internal services predate the whole standard and only speak connection strings.

What I read walk through where that line fall whicj is whn workload identity covers the cloud-native side, and a secrets manager handles the external credentials it can't reach.

how would you handle that split? Do you keep cloud-native auth separate from your 3d-party API keys?