What is the main advantage of using OIDC tokens to authenticate with cloud providers like AWS instead of storing long-lived credentials as secrets?
Select an answer to reveal the explanation.
Short Explanation and Infographic
OIDC is the keyless entry for cloud auth — GitHub vouches for the workflow, the cloud issues a temporary badge, and nothing sensitive is stored.
Full explanation below image
Full Explanation
With OIDC (OpenID Connect), GitHub Actions acts as an identity provider. The workflow requests a short-lived JWT token from GitHub, presents it to the cloud provider (AWS, Azure, GCP), which exchanges it for temporary credentials based on trust policies you configure. Benefits: no long-lived access keys stored as secrets, no secret rotation needed, tokens expire automatically, and cloud audit logs show exactly which workflow run used which permissions. You DO need to configure the cloud provider's trust policy (e.g., AWS IAM OIDC provider). OIDC doesn't bypass cloud permission models — it uses them.