TOPIC SECURITY
OIDC Federation secretless repository authentication for CI/CD actions
IN 10 SECONDS
Secretless authentication. Instead of saving permanent password keys (which can leak) inside your deployment pipelines to access cloud resources, your pipeline gets a temporary trust token from its platform and swaps it for a short-lived key at runtime.
GOTCHA If you don't restrict which repositories are trusted in your cloud configuration, any public repository on that platform could request access and hijack your cloud account.
HOW A TRUST EXCHANGE FLOWS
01 Pipeline runs a job and requests a signed identity token from its host platform.
02 Platform issues a temporary token confirming the repository name and job details.
03 Cloud Provider receives the token, checks the signature, and validates the repository name.
04 Cloud IAM exchanges the token for temporary access keys that expire in an hour.
POKE IT YOURSELF
aws sts assume-role-with-web-identity --role-arn arn:aws:iam::... --web-identity-token $JWT — manually trade JWT for AWS credentials
Drill this topic →
~80 sec read