GitHub Actions OIDC
Why prefer GitHub Actions OIDC federation to AWS/Azure/GCP over storing long-lived cloud access keys?
Answers use simple, clear English.
Quick interview answer
OIDC issues short-lived tokens; cloud IAM trusts GitHub’s identity with conditions on repo, branch, and environment. No static keys to leak from secrets or logs. Compromise blast radius is time-bound.
Detailed answer
OIDC issues short-lived tokens; cloud IAM trusts GitHub’s identity with conditions on repo, branch, and environment. No static keys to leak from secrets or logs. Compromise blast radius is time-bound. Still must tighten subject claims — a wild-card trust is dangerous.
Real example & use case
Deploy job on main assumes aws-role/github-prod only when github.ref == refs/heads/main.
Pros & cons
Pros: no long-lived keys. Cons: initial IAM/trust setup complexity.