cloudidentitysecurity.com

"topic": "federation" · 5 guides

CI/CD federation

Setting up OIDC trust from pipelines to cloud accounts, and scoping it tightly.

  1. job/github-oidc-immutable-subject category CI/CD federation

    GitHub's immutable OIDC subject claims, fixed in AWS, Azure and Google Cloud

    Repositories created after July 15, 2026 send a new sub format with owner and repository IDs. What changed, how to tell which format you get, and the trust changes for each cloud.

    · 8 min
  2. job/github-actions-aws-oidc category CI/CD federation

    Scoping a GitHub Actions trust policy in AWS

    Which condition keys to use in an IAM role trust policy for GitHub Actions, which ones are immutable, and worked examples for a branch, an environment and a reusable workflow.

    · 8 min
  3. job/github-oidc-trust-aws category CI/CD federation

    One workflow, three clouds: how AWS, Azure and Google Cloud match GitHub OIDC tokens

    The same GitHub Actions token is checked three different ways. A side-by-side comparison of where the trust lives, how claims are matched, wildcard support, limits and how failures show up.

    · 7 min
  4. job/gitlab-ci-oidc-trust category CI/CD federation

    Scoping GitLab CI OIDC trust in AWS, Azure and Google Cloud

    How GitLab ID tokens are matched by each cloud, which claims stay stable when a project moves, and worked trust configurations for a protected branch on GitLab.com.

    · 7 min
  5. job/hcp-terraform-dynamic-credentials category CI/CD federation

    Scoping HCP Terraform dynamic credentials: trust for plan and apply

    How HCP Terraform workload identity tokens are built, why plan and apply deserve different roles, and the trust configuration each cloud needs.

    · 7 min

Have a policy to test? Use the OIDC trust checker.