A broker can separate clients from powerful credentials
Rather than giving somebody the credential, give them a service that uses the credential on their behalf.
The powerful secret never leaves the broker, the request is recorded, and access can be withdrawn without rotating anything. It is how privileged access management works, and the same pattern applies to database access, cloud keys and administrative APIs.
More on Architecture patterns
- A jump host concentrates administrative entryOne plank, every crossing
- A bastion should not become a general-purpose workstationIt only has the one job
- Bulkheads contain failureThe water stops at the wall
- Out-of-band management survives primary-path failureWhen the bridge is out
- A choke point makes control observableEverything through one gap
- A one-way gateway changes the threat modelWater does not fall upwards