# 12 terms
Glossary
The terms the guides and the checker use, defined once.
- Attribute condition
- A Common Expression Language (CEL) expression attached to a Google Cloud workload identity pool provider. Tokens that don't satisfy it are rejected before any IAM binding is considered. Google's guidance requires one for GitHub providers.
- Audience (aud)
- The claim that says who the token is for. AWS expects sts.amazonaws.com by default; Microsoft Entra recommends api://AzureADTokenExchange. Checking it stops a token minted for one service from being replayed at another.
- Claim
- One name/value pair in a token's payload. Standard claims include iss (issuer), sub (subject), aud (audience) and exp (expiry). GitHub adds custom claims such as repository, repository_id, ref and environment.
- Federated identity credential
- A record on a Microsoft Entra app registration or user-assigned managed identity that lets an external token be exchanged for an Entra token. A plain credential matches issuer, subject and audience exactly; a flexible credential uses a claims-matching expression. Up to 20 per app or identity.
- Immutable subject claim
- GitHub's subject format that adds the numeric owner and repository IDs after an @ sign: repo:OWNER@OWNER_ID/REPO@REPO_ID:… The IDs are never reused, so a trust rule written against them stays bound to the original repository through renames and transfers.
- Issuer (iss)
- The claim naming the identity provider that signed the token. For GitHub Actions on github.com it is https://token.actions.githubusercontent.com. Shared issuers like this one serve every customer, so the issuer alone proves nothing about which organization a job belongs to.
- JSON Web Token (JWT)
- A compact token in three base64url parts separated by dots: a header (algorithm and key id), a payload (the claims) and a signature. The cloud provider checks the signature against the issuer's published keys, then evaluates the claims against your trust configuration.
- OpenID Connect (OIDC)
- An identity layer built on OAuth 2.0. In CI/CD, the platform (GitHub, GitLab, HCP Terraform) acts as the identity provider and issues each job a signed JSON Web Token describing where it runs. A cloud account that trusts that provider can exchange the token for short-lived credentials.
- Subject (sub)
- The claim that identifies the workload. GitHub builds it from the repository and the job context, for example repo:octo-org/octo-repo:ref:refs/heads/main or repo:octo-org/octo-repo:environment:prod. Since July 15, 2026, new repositories include numeric IDs: repo:octo-org@123456/octo-repo@456789:…
- Subject recycling
- The risk that a name used in a trust rule (an organization, user, group or repository path) is deleted or renamed, then registered by someone else, who can then produce tokens with an identical subject. Matching on immutable IDs removes it.
- Trust policy
- The resource policy attached to an AWS IAM role that says which principals may assume it and under which conditions. For OIDC federation, it names the identity provider as the Federated principal, allows sts:AssumeRoleWithWebIdentity and compares token claims in its Condition block.
- Workload identity federation
- Letting software that runs outside a cloud (a CI job, a Kubernetes pod, another cloud's VM) exchange a token from its own identity provider for short-lived credentials, instead of storing long-lived keys. AWS, Microsoft Entra and Google Cloud each implement it with their own matching rules.