Which authentication approach lets a GitHub Actions workflow obtain short-lived cloud credentials from AWS, Azure, or GCP without storing long-lived cloud access keys as GitHub secrets?
Select an answer to reveal the explanation.
Short Explanation and Infographic
OIDC lets the workflow request a JWT from GitHub that the cloud provider trusts via a configured identity provider, exchanging it for temporary credentials — no static keys in secrets.
Full explanation below image
Full Explanation
GitHub Actions can request an OIDC token (JWT) that cloud providers validate against GitHub's OIDC issuer. You configure a trust policy (for example an AWS IAM role trust with sub claim conditions on repo or ref) and use actions such as aws-actions/configure-aws-credentials with role-to-assume. Temporary credentials are issued for the job. This removes long-lived keys from GitHub secrets and reduces blast radius if a workflow log leaks. Putting keys in the README is insecure. Emailing keys is not a supported pattern. GITHUB_TOKEN authenticates to GitHub APIs, not to AWS, Azure, or GCP as a general cloud credential. Permissions often need id-token: write to request the OIDC JWT successfully.