Let CI sign in with OIDC

How to do it

The CI system signs a token that names the repository, branch and environment. The cloud trusts that issuer and swaps the token for credentials that last 1 hour at most. Limit the trust to one repository and one branch or environment through the sub claim. Never trust a whole organization or a wildcard. Since 15 July 2026, GitHub gives new and renamed repositories a sub with fixed IDs, such as repo:example@1234/shop@5678:environment:production. Copy the exact prefix from the repository's OIDC settings rather than writing it from memory. GitHub Actions, GitLab CI, Bitbucket and CircleCI all issue such tokens. AWS, Google Cloud and Azure all accept them.

Example

resource "aws_iam_openid_connect_provider" "github" {
  url            = "https://token.actions.githubusercontent.com"
  client_id_list = ["sts.amazonaws.com"]
}

data "aws_iam_policy_document" "deploy_trust" {
  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]
    principals {
      type        = "Federated"
      identifiers = [aws_iam_openid_connect_provider.github.arn]
    }
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:example/shop:environment:production"]
    }
  }
}

permissions:
  id-token: write
  contents: read
steps:
  - uses: aws-actions/configure-aws-credentials@<commit-sha>
    with:
      role-to-assume: arn:aws:iam::111122223333:role/deploy-production
      aws-region: eu-north-1

How to check

The CI secret list holds no cloud key. The trust policy has a sub condition with no *. Run the workflow from another branch, and the cloud refuses the token.