# 7 guides · every claim linked to the vendor's own docs
Guides
Setting up, scoping and debugging OIDC trust from CI/CD pipelines to cloud accounts.
- job/github-oidc-immutable-subject category CI/CD federation
GitHub's immutable OIDC subject claims, fixed in AWS, Azure and Google Cloud
Repositories created after July 15, 2026 send a new sub format with owner and repository IDs. What changed, how to tell which format you get, and the trust changes for each cloud.
· 8 min - job/fix-not-authorized-assumerolewithwebidentity category Troubleshooting
Fixing “Not authorized to perform sts:AssumeRoleWithWebIdentity” in GitHub Actions
A checklist for the AWS OIDC error, ordered by how often each cause applies: sub format, job context, wildcards under StringEquals, audience, provider ARN and customized claims.
· 7 min - job/github-actions-aws-oidc category CI/CD federation
Scoping a GitHub Actions trust policy in AWS
Which condition keys to use in an IAM role trust policy for GitHub Actions, which ones are immutable, and worked examples for a branch, an environment and a reusable workflow.
· 8 min - job/github-oidc-trust-aws category CI/CD federation
One workflow, three clouds: how AWS, Azure and Google Cloud match GitHub OIDC tokens
The same GitHub Actions token is checked three different ways. A side-by-side comparison of where the trust lives, how claims are matched, wildcard support, limits and how failures show up.
· 7 min - job/oidc-subject-recycling category Risks
Subject recycling: when a deleted GitHub name still unlocks your cloud role
Trust rules that match names can be satisfied by whoever registers that name next. What the 2026 research found, what GitHub, GitLab and the clouds changed, and how to audit your own roles.
· 7 min - job/gitlab-ci-oidc-trust category CI/CD federation
Scoping GitLab CI OIDC trust in AWS, Azure and Google Cloud
How GitLab ID tokens are matched by each cloud, which claims stay stable when a project moves, and worked trust configurations for a protected branch on GitLab.com.
· 7 min - job/hcp-terraform-dynamic-credentials category CI/CD federation
Scoping HCP Terraform dynamic credentials: trust for plan and apply
How HCP Terraform workload identity tokens are built, why plan and apply deserve different roles, and the trust configuration each cloud needs.
· 7 min
By topic
CI/CD federation
Setting up OIDC trust from pipelines to cloud accounts, and scoping it tightly.
Troubleshooting
Why a workflow is refused, read from the token and the policy.
Risks
Ways federated trust goes wrong after it is set up.