OIDC Federation (CI to Cloud) - CI/CD Glossary Definition
OIDC federation is how a GitHub Actions job authenticates to AWS, Azure, or GCP without any long-lived secret stored in the repository.
OIDC federation lets a CI workflow present a signed identity token to a cloud provider, which trades it for short-lived credentials instead of the workflow holding a static access key.
With federation, the cloud trusts tokens issued by GitHub only when they match a configured subject claim (repo, branch, or environment), so credentials cannot leak from a stored secret.
Related guides
Workload Identity - CI/CD Glossary DefinitionWorkload Identity: Workload identity is the practice of giving an automated workload (a CI job, service, or p…
Short-Lived Credentials - CI/CD Glossary DefinitionShort-Lived Credentials: Short-lived credentials are access tokens that expire minutes after issue, so a leak…
Secretless CI - CI/CD Glossary DefinitionSecretless CI: Secretless CI is a pipeline design where no long-lived secrets are stored in the repository or…