What is the primary security benefit of using OpenID Connect (OIDC) federation from GitHub Actions to cloud providers instead of storing long-lived cloud access keys as repository secrets?
Select an answer to reveal the explanation.
Short Explanation and Infographic
OIDC federation issues short-lived cloud credentials from signed workflow identity claims, so you can drop standing access keys from GitHub secrets. Still least-privilege the cloud role—no free admin.
Full explanation below image
Full Explanation
GitHub Actions can request an OIDC token that cloud providers validate against federation trust policies bound to repository, environment, or other claims. The provider then issues temporary credentials, so long-lived access keys need not live in GitHub secrets. OIDC federation for cloud IAM is separate from authenticating to language package registries, does not imply unrestricted cloud admin rights—roles must still be least privilege—and it does not disable runner egress. Administrators should pin trust conditions to specific repos and environments, prefer environment gates for production roles, and retire static keys during migration.