---
title: "Let CI sign in with OIDC · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/oidc-for-ci
updated: 2026-10-20
licence: "All rights reserved"
---

# Let CI sign in with OIDC

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Configuration and secrets](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets)
- Rule: Let pipelines sign in to the cloud with a short-lived token from the CI provider's OIDC issuer. Store no cloud key in CI secrets.
- How: The CI system signs a token that names the repository, branch and environment. The cloud trusts that issuer and swaps the token for credentials that last 1 hour at most. Limit the trust to one repository and one branch or environment through the `sub` claim. Never trust a whole organization or a wildcard. Since 15 July 2026, GitHub gives new and renamed repositories a `sub` with fixed IDs, such as `repo:example@1234/shop@5678:environment:production`. Copy the exact prefix from the repository's OIDC settings rather than writing it from memory. GitHub Actions, GitLab CI, Bitbucket and CircleCI all issue such tokens. AWS, Google Cloud and Azure all accept them.
- Check: The CI secret list holds no cloud key. The trust policy has a `sub` condition with no `*`. Run the workflow from another branch, and the cloud refuses the token.

Example:

```hcl
resource "aws_iam_openid_connect_provider" "github" {
  url            = "https://token.actions.githubusercontent.com"
  client_id_list = ["sts.amazonaws.com"]
}

data "aws_iam_policy_document" "deploy_trust" {
  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]
    principals {
      type        = "Federated"
      identifiers = [aws_iam_openid_connect_provider.github.arn]
    }
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:example/shop:environment:production"]
    }
  }
}
```

```yaml
permissions:
  id-token: write
  contents: read
steps:
  - uses: aws-actions/configure-aws-credentials@<commit-sha>
    with:
      role-to-assume: arn:aws:iam::111122223333:role/deploy-production
      aws-region: eu-north-1
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/oidc-for-ci`.

- Previous: [Keep secrets out of state](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/secrets-out-of-state)
- Next: [Give services the identity of their machine](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/workload-identity)
- [Configuration and secrets](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets)