Workload Identity Federation
ELI5 - The Vibe Check
Instead of handing your CI pipeline a long-lived cloud password it has to keep safe forever, workload identity federation lets the pipeline show up and prove "I really am this GitHub Actions run, for this repo, right now," and the cloud provider trusts that claim and hands back temporary permissions. No secret ever sits in a config file waiting to leak.
Real Talk
Workload identity federation lets an external identity provider, such as a CI system or Kubernetes cluster, exchange a short-lived, cryptographically verifiable token for temporary cloud credentials, without storing a long-lived static secret. It's built on OIDC trust relationships between the workload's identity provider and the cloud provider's IAM.
Show Me The Code
permissions:
id-token: write # required to request the OIDC token
contents: read
steps:
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/gha-deploy
aws-region: eu-west-1
# no static AWS keys anywhere in this repo
When You'll Hear This
"We swapped the long-lived AWS keys in GitHub Actions for workload identity federation." / "OIDC-based workload identity federation means there's no service account key to rotate or leak."
Related Terms
IAM (Identity and Access Management)
IAM is the permission system for AWS. It controls who (users, roles, services) can do what (read S3, start EC2, invoke Lambda) on which resources.
OIDC in CI
OIDC in CI means your CI pipeline proves its identity to cloud providers without storing long-lived secrets.
Service Account
A service account is a special non-human account that your app or service uses to authenticate with cloud APIs.
Token
In AI-land, a token is a chunk of text — roughly 3/4 of a word.
Zero Trust
Zero trust means 'never trust, always verify' — even if a request comes from inside your network.