hashicorp/nomad · warning

while multiple audiences is allowed, it is more secure to us

Error message

while multiple audiences is allowed, it is more secure to use 1 audience per identity

What it means

WorkloadIdentity.Warnings advises against declaring more than one Audience on a single identity. Multiple audiences widen the token's acceptability and make the aud claim ambiguous; one audience per identity is the secure pattern.

Source

Thrown at nomad/structs/workload_id.go:510

	if wi.Filepath != "" && !wi.File {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("file parameter must be true in order to specify filepath"))
	}

	return mErr.ErrorOrNil()
}

func (wi *WorkloadIdentity) Warnings() error {
	if wi == nil {
		return fmt.Errorf("must not be nil")
	}

	var mErr multierror.Error

	if n := len(wi.Audience); n == 0 {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("identities without an audience are insecure"))
	} else if n > 1 {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("while multiple audiences is allowed, it is more secure to use 1 audience per identity"))
	}

	if wi.Name != "" && wi.Name != WorkloadIdentityDefaultName {
		if wi.TTL == 0 {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("identities without an expiration are insecure"))
		}
	}

	// Warn users about using env vars without restarts
	if wi.Env && wi.ChangeMode != WIChangeModeRestart {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("using env=%t without change_mode=%q may result in task not getting updated identity",
			wi.Env, WIChangeModeRestart))
	}

	return mErr.ErrorOrNil()
}

// WorkloadIdentityRequest encapsulates the 3 parameters used to generated a

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Split into one identity per consumer, each with a single audience.
2. Remove the extra audience entries that are not needed by the task's workload validator.
3. If multiple audiences are truly required, document the rationale; the warning is advisory and does not block the job.

Example fix

// before
identity {
  name = "shared"
  audience = ["aws", "vault"]
}
// after
identity {
  name = "aws"
  audience = ["aws"]
}
identity {
  name = "vault"
  audience = ["vault"]
}

func validateSingleAudience(wi *structs.WorkloadIdentity) error {
  if len(wi.Audience) > 1 {
    return fmt.Errorf("identity %q declares %d audiences; use one identity per audience", wi.Name, len(wi.Audience))
  }
  return nil
}

When it happens

Trigger: An identity block with audience = ["a", "b"] (len(wi.Audience) > 1) when Warnings() is called, i.e. two or more entries in wi.Audience.

Common situations: Reusing one identity for several consumers (e.g. AWS and Vault) instead of defining separate identities; bulk-copying audience lists into every identity block.

Related errors

• identities without an audience are insecure
• identities without an expiration are insecure
• no signed workload identity available
• error getting signed identity for task %s: %v
• error getting signed identity for service %s: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/56c16723049bda2b. Report an issue: GitHub.