[{"data":1,"prerenderedAt":204},["ShallowReactive",2],{"term-w\u002Fworkload-identity-federation":3,"related-w\u002Fworkload-identity-federation":182},{"id":4,"title":5,"acronym":6,"body":7,"category":163,"description":164,"difficulty":165,"extension":166,"letter":167,"meta":168,"navigation":86,"path":169,"related":170,"seo":176,"sitemap":177,"stem":180,"subcategory":6,"__hash__":181},"terms\u002Fterms\u002Fw\u002Fworkload-identity-federation.md","Workload Identity Federation",null,{"type":8,"value":9,"toc":157},"minimark",[10,15,19,23,26,30,146,150,153],[11,12,14],"h2",{"id":13},"eli5-the-vibe-check","ELI5 - The Vibe Check",[16,17,18],"p",{},"Instead of handing your CI pipeline a long-lived cloud password it has to keep safe forever, workload identity federation lets the pipeline show up and prove \"I really am this GitHub Actions run, for this repo, right now,\" and the cloud provider trusts that claim and hands back temporary permissions. No secret ever sits in a config file waiting to leak.",[11,20,22],{"id":21},"real-talk","Real Talk",[16,24,25],{},"Workload identity federation lets an external identity provider, such as a CI system or Kubernetes cluster, exchange a short-lived, cryptographically verifiable token for temporary cloud credentials, without storing a long-lived static secret. It's built on OIDC trust relationships between the workload's identity provider and the cloud provider's IAM.",[11,27,29],{"id":28},"show-me-the-code","Show Me The Code",[31,32,37],"pre",{"className":33,"code":34,"language":35,"meta":36,"style":36},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","permissions:\n  id-token: write   # required to request the OIDC token\n  contents: read\n\nsteps:\n  - uses: aws-actions\u002Fconfigure-aws-credentials@v4\n    with:\n      role-to-assume: arn:aws:iam::123456789012:role\u002Fgha-deploy\n      aws-region: eu-west-1\n      # no static AWS keys anywhere in this repo\n","yaml","",[38,39,40,53,70,81,88,96,110,118,129,140],"code",{"__ignoreMap":36},[41,42,45,49],"span",{"class":43,"line":44},"line",1,[41,46,48],{"class":47},"swJcz","permissions",[41,50,52],{"class":51},"sMK4o",":\n",[41,54,56,59,62,66],{"class":43,"line":55},2,[41,57,58],{"class":47},"  id-token",[41,60,61],{"class":51},":",[41,63,65],{"class":64},"sfazB"," write",[41,67,69],{"class":68},"sHwdD","   # required to request the OIDC token\n",[41,71,73,76,78],{"class":43,"line":72},3,[41,74,75],{"class":47},"  contents",[41,77,61],{"class":51},[41,79,80],{"class":64}," read\n",[41,82,84],{"class":43,"line":83},4,[41,85,87],{"emptyLinePlaceholder":86},true,"\n",[41,89,91,94],{"class":43,"line":90},5,[41,92,93],{"class":47},"steps",[41,95,52],{"class":51},[41,97,99,102,105,107],{"class":43,"line":98},6,[41,100,101],{"class":51},"  -",[41,103,104],{"class":47}," uses",[41,106,61],{"class":51},[41,108,109],{"class":64}," aws-actions\u002Fconfigure-aws-credentials@v4\n",[41,111,113,116],{"class":43,"line":112},7,[41,114,115],{"class":47},"    with",[41,117,52],{"class":51},[41,119,121,124,126],{"class":43,"line":120},8,[41,122,123],{"class":47},"      role-to-assume",[41,125,61],{"class":51},[41,127,128],{"class":64}," arn:aws:iam::123456789012:role\u002Fgha-deploy\n",[41,130,132,135,137],{"class":43,"line":131},9,[41,133,134],{"class":47},"      aws-region",[41,136,61],{"class":51},[41,138,139],{"class":64}," eu-west-1\n",[41,141,143],{"class":43,"line":142},10,[41,144,145],{"class":68},"      # no static AWS keys anywhere in this repo\n",[11,147,149],{"id":148},"when-youll-hear-this","When You'll Hear This",[16,151,152],{},"\"We swapped the long-lived AWS keys in GitHub Actions for workload identity federation.\" \u002F \"OIDC-based workload identity federation means there's no service account key to rotate or leak.\"",[154,155,156],"style",{},"html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":36,"searchDepth":55,"depth":55,"links":158},[159,160,161,162],{"id":13,"depth":55,"text":14},{"id":21,"depth":55,"text":22},{"id":28,"depth":55,"text":29},{"id":148,"depth":55,"text":149},"security","Instead of handing your CI pipeline a long-lived cloud password it has to keep safe forever, workload identity federation lets the pipeline show up and pro...","advanced","md","w",{},"\u002Fterms\u002Fw\u002Fworkload-identity-federation",[171,172,173,174,175],"OIDC in CI","IAM","Service Account","Zero Trust","Token",{"title":5,"description":164},{"changefreq":178,"priority":179},"weekly",0.7,"terms\u002Fw\u002Fworkload-identity-federation","MiqCYEtjueZOOMR9SE8xmeBHBJHjeF7As1Zircesdjc",[183,189,193,196,201],{"title":172,"path":184,"acronym":185,"category":186,"difficulty":187,"description":188},"\u002Fterms\u002Fi\u002Fiam","Identity and Access Management","cloud","intermediate","IAM is the permission system for AWS. It controls who (users, roles, services) can do what (read S3, start EC2, invoke Lambda) on which resources.",{"title":171,"path":190,"acronym":6,"category":191,"difficulty":165,"description":192},"\u002Fterms\u002Fo\u002Foidc-in-ci","cicd","OIDC in CI means your CI pipeline proves its identity to cloud providers without storing long-lived secrets.",{"title":173,"path":194,"acronym":6,"category":186,"difficulty":187,"description":195},"\u002Fterms\u002Fs\u002Fservice-account","A service account is a special non-human account that your app or service uses to authenticate with cloud APIs.",{"title":175,"path":197,"acronym":6,"category":198,"difficulty":199,"description":200},"\u002Fterms\u002Ft\u002Ftoken","vibecoding","beginner","In AI-land, a token is a chunk of text — roughly 3\u002F4 of a word.",{"title":174,"path":202,"acronym":6,"category":163,"difficulty":187,"description":203},"\u002Fterms\u002Fz\u002Fzero-trust","Zero trust means 'never trust, always verify' — even if a request comes from inside your network.",1792528063807]