hashicorp/nomad · warning

identities without an audience are insecure

Error message

identities without an audience are insecure

What it means

WorkloadIdentity.Warnings flags identities that declare no Audience. Audience-less workload identities are considered insecure because the resulting JWT could be accepted by any workload validator; Nomad emits this as a warning, not a hard validation failure.

Source

Thrown at nomad/structs/workload_id.go:508

		mErr.Errors = append(mErr.Errors, fmt.Errorf("ttl must be >= 0"))
	}

	if wi.Filepath != "" && !wi.File {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("file parameter must be true in order to specify filepath"))
	}

	return mErr.ErrorOrNil()
}

func (wi *WorkloadIdentity) Warnings() error {
	if wi == nil {
		return fmt.Errorf("must not be nil")
	}

	var mErr multierror.Error

	if n := len(wi.Audience); n == 0 {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("identities without an audience are insecure"))
	} else if n > 1 {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("while multiple audiences is allowed, it is more secure to use 1 audience per identity"))
	}

	if wi.Name != "" && wi.Name != WorkloadIdentityDefaultName {
		if wi.TTL == 0 {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("identities without an expiration are insecure"))
		}
	}

	// Warn users about using env vars without restarts
	if wi.Env && wi.ChangeMode != WIChangeModeRestart {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("using env=%t without change_mode=%q may result in task not getting updated identity",
			wi.Env, WIChangeModeRestart))
	}

	return mErr.ErrorOrNil()
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Add one audience entry to the identity block, e.g. audience = ["aws"] matching the target workload's expected aud claim.
2. Set Audience in Go: wi.Audience = []string{"aws"} before validation.
3. If the warning is intentional for local testing, acknowledge and suppress it in your tooling, but add audiences before production.

Example fix

// before
identity {
  name = "aws"
}
// after
identity {
  name = "aws"
  audience = ["aws"]
}

func validateAudience(wi *structs.WorkloadIdentity) error {
  if len(wi.Audience) == 0 {
    return fmt.Errorf("identity %q must declare at least one audience", wi.Name)
  }
  return nil
}

When it happens

Trigger: An identity block with no audience entries (len(wi.Audience) == 0) when Warnings() is called, e.g. identity { name = "aws" } with no audience list in HCL or structs.WorkloadIdentity{Audience: nil} in Go.

Common situations: Omitting audience because the docs example omitted it; assuming Nomad injects a default audience; older job files written before audience best practices were adopted.

Related errors

• while multiple audiences is allowed, it is more secure to us
• identities without an expiration are insecure
• no signed workload identity available
• error getting signed identity for task %s: %v
• error getting signed identity for service %s: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2ea44416fca180d4. Report an issue: GitHub.