Cheat Sheet logoCheat Sheet Today
CI/CD Pipelines: Security, Secrets, and Governance/Use OIDC instead of long-lived cloud keys

Exchange a short-lived identity token for cloud credentials.

Back to sheetBrowse commands
Sign in to save
Section: Harden pipeline credentials and permissions

Use OIDC instead of long-lived cloud keys

yaml
yaml
permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
      aws-region: us-east-1
Explanation

OIDC reduces secret sprawl by replacing stored cloud keys with short-lived federated credentials.

View in sheet →

Learn the surrounding workflow

Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.

Compare commandsView fixes

Related commands

Same sheet · prioritizing Harden pipeline credentials and permissions
Use least-privilege permissions in GitHub Actions
Explicitly scope the token for each workflow or job.
OpenIn sheetyamlsame section
Protect production variables in GitLab
Restrict sensitive variables to protected branches or tags.
OpenIn sheetyamlsame section
Be careful with untrusted pull requests
Avoid exposing secrets to code from forks.
OpenIn sheetyaml1 tag match
Require approval for production release
Add environment rules or manual gates before prod deploys.
OpenIn sheettext1 tag match
Pin actions to a version or commit
Avoid floating references for critical workflow dependencies.
OpenIn sheetyaml