How can GitHub Actions workflows authenticate to external cloud providers (AWS, Azure, GCP) without storing long-lived credentials as secrets?
Select an answer to reveal the explanation.
Short Explanation and Infographic
OIDC federation is the keyless unlock for cloud deployments. Instead of storing an AWS access key as a GitHub secret, GitHub Actions gets an OIDC token proving 'this is a workflow in repo X running on branch Y' — AWS trusts GitHub's identity provider and issues a temporary role credential. No secrets to rotate.
Full explanation below image
Full Explanation
GitHub Actions supports OpenID Connect (OIDC) integration with major cloud providers (AWS, Azure, GCP, HashiCorp Vault, and others) for keyless authentication. The OIDC flow: (1) GitHub Actions generates a short-lived OIDC token (JWT) signed by GitHub's identity provider for each workflow run. (2) The token contains claims about the workflow's context (repository, branch, environment, actor). (3) The cloud provider's identity system is configured to trust GitHub's OIDC endpoint and map specific claims to cloud roles. (4) The workflow exchanges the OIDC token for a short-lived cloud credential (IAM role, service principal, etc.). Benefits: no long-lived secrets stored in GitHub, credentials expire automatically, fine-grained trust policies based on repo/branch/environment. This is considered best practice over static secrets.