https://cloudidentitysecurity.com/A free, in-browser checker and practical guides for OIDC trust from GitHub Actions, GitLab CI and HCP Terraform to AWS, Azure and Google Cloud.en-ushttps://cloudidentitysecurity.com/guides/github-oidc-immutable-subject-claims/https://cloudidentitysecurity.com/guides/github-oidc-immutable-subject-claims/Repositories created after July 15, 2026 send a new sub format with owner and repository IDs. What changed, how to tell which format you get, and the trust changes for each cloud.Tue, 10 Nov 2026 00:00:00 GMThttps://cloudidentitysecurity.com/guides/fix-not-authorized-assumerolewithwebidentity/https://cloudidentitysecurity.com/guides/fix-not-authorized-assumerolewithwebidentity/A checklist for the AWS OIDC error, ordered by how often each cause applies: sub format, job context, wildcards under StringEquals, audience, provider ARN and customized claims.Tue, 10 Nov 2026 00:00:00 GMThttps://cloudidentitysecurity.com/guides/github-actions-aws-oidc-trust-policy/https://cloudidentitysecurity.com/guides/github-actions-aws-oidc-trust-policy/Which condition keys to use in an IAM role trust policy for GitHub Actions, which ones are immutable, and worked examples for a branch, an environment and a reusable workflow.Tue, 10 Nov 2026 00:00:00 GMThttps://cloudidentitysecurity.com/guides/github-oidc-trust-aws-azure-gcp/https://cloudidentitysecurity.com/guides/github-oidc-trust-aws-azure-gcp/The same GitHub Actions token is checked three different ways. A side-by-side comparison of where the trust lives, how claims are matched, wildcard support, limits and how failures show up.Tue, 10 Nov 2026 00:00:00 GMThttps://cloudidentitysecurity.com/guides/oidc-subject-recycling/https://cloudidentitysecurity.com/guides/oidc-subject-recycling/Trust rules that match names can be satisfied by whoever registers that name next. What the 2026 research found, what GitHub, GitLab and the clouds changed, and how to audit your own roles.Tue, 10 Nov 2026 00:00:00 GMThttps://cloudidentitysecurity.com/guides/gitlab-ci-oidc-trust-aws-azure-gcp/https://cloudidentitysecurity.com/guides/gitlab-ci-oidc-trust-aws-azure-gcp/How GitLab ID tokens are matched by each cloud, which claims stay stable when a project moves, and worked trust configurations for a protected branch on GitLab.com.Tue, 10 Nov 2026 00:00:00 GMThttps://cloudidentitysecurity.com/guides/hcp-terraform-dynamic-credentials-trust/https://cloudidentitysecurity.com/guides/hcp-terraform-dynamic-credentials-trust/How HCP Terraform workload identity tokens are built, why plan and apply deserve different roles, and the trust configuration each cloud needs.Tue, 10 Nov 2026 00:00:00 GMT