What is 'OpenID Connect (OIDC)' in GitHub Actions and what problem does it solve?
Select an answer to reveal the explanation.
Short Explanation and Infographic
OIDC in Actions kills the long-lived cloud credential problem. Instead of storing AWS_ACCESS_KEY_ID as a secret (which never expires and needs manual rotation), the workflow gets a short-lived token from GitHub's OIDC provider and exchanges it for temporary AWS credentials. Credentials that expire in hours, not years.
Full explanation below image
Full Explanation
GitHub Actions' OpenID Connect (OIDC) support enables workflows to obtain short-lived credentials from cloud providers without storing static credentials as repository secrets. How it works: (1) GitHub acts as an OIDC identity provider, issuing JWT tokens to each workflow run. (2) The token contains claims: repository, organization, branch, event type, environment. (3) Cloud providers (AWS, Azure, GCP, Vault, etc.) are configured to trust GitHub's OIDC provider. (4) The workflow exchanges the GitHub JWT for temporary cloud credentials (e.g., AWS STS session tokens). (5) Temporary credentials expire after the job completes. Benefits: no secret rotation required, credentials are automatically short-lived, cloud audit logs show which workflow/branch/repo made requests (better attribution), and compromised credentials have minimal lifespan.