oidc-federation-patterns

OpenID Connect federation enables secretless cloud authentication by exchanging GitHub Actions OIDC tokens for short-lived cloud credentials. You configure a trust policy in your cloud provider to validate the workflow's subject claims and grant temporary access.

Trust policies for OIDC federation validate repository, branch, and environment subject claims to grant least-privilege access across GCP and Azure. You define conditions mapping GitHub Actions workflows to specific cloud roles for short-lived credential exchange.

OIDC subject claim patterns define repository, branch, and environment attributes in a GitHub Actions workflow token. You need them when configuring trust policies to ensure only authorized CI/CD pipelines can exchange tokens for short-lived cloud credentials.

OIDC federation supports multi-provider setups, enabling GitHub Actions workflows to obtain short-lived credentials across GCP, Azure, and additional platforms simultaneously. You configure distinct trust policies for each provider to manage least-privilege access.

OIDC federation replaces long-lived credentials with short-lived tokens, reducing secret sprawl and security risk in CI/CD pipelines. By using OpenID Connect trust policies, GitHub Actions workflows access cloud resources without storing static secrets.

You need the gcloud CLI to automate OIDC federation for GCP access, as it handles configuring trust policies and exchanging GitHub Actions OIDC tokens for short-lived cloud credentials. The automation scripts depend on gcloud to manage provider setup.