Quick Notes116 words
Secretless authentication — quick notes
Secretless authentication — quick notes
| Step | Detail |
|---|---|
| 1 | Establish OIDC trust in the cloud provider |
| 2 | Provider auto-generates a JWT with claims each run |
| 3 | Workflow presents it as proof of identity |
| 4 | Cloud returns a short-lived token, valid for that job only |
Three documented benefits: no cloud secrets · granular authN/authZ via the cloud provider · automatically rotating credentials.
- The
subclaim references repository and environment — scope the trust to claims. - Azure Pipelines equivalent: workload identity federation service connections.
Trap: trusting the whole organisation instead of specific claims lets any workflow assume a production role.