#OIDC

8 articles tagged with OIDC.

Keyless Deploys to AWS with GitHub Actions OIDC

Stop stashing long-lived AWS access keys in GitHub secrets and let OIDC hand your workflows short-lived, scoped credentials instead.

Kiril Urbonas·12

Read article

GitHub Actions OIDC gets all the attention, but GitLab, Buildkite, and CircleCI issue the same signed tokens. Here's how to trust them without opening a hole.

••last month

OIDC Federation Beyond GitHub — GitLab, Buildkite, and Generic Providers

GitHub Actions OIDC gets all the attention, but GitLab, Buildkite, and CircleCI issue the same signed tokens. Here's how to trust them without opening a hole.

Kiril Urbonas·10

Read article

How pods can talk to AWS, GCP, and Azure with no static keys — using audience-bound projected ServiceAccount tokens and the cluster OIDC issuer.

••2 months ago

Kubernetes Workload Identity — Projected Tokens and OIDC to Cloud IAM

How pods can talk to AWS, GCP, and Azure with no static keys — using audience-bound projected ServiceAccount tokens and the cluster OIDC issuer.

Kiril Urbonas·9

Read article

We ripped every client secret out of our CI pipelines by pointing Azure federated credentials at GitHub's OIDC issuer. Here's the exact setup and the claims that trip people up.

••2 months ago

Azure Workload Identity Federation Without Secrets

We ripped every client secret out of our CI pipelines by pointing Azure federated credentials at GitHub's OIDC issuer. Here's the exact setup and the claims that trip people up.

Kiril Urbonas·8

Read article

Long-lived access keys are the root cause behind most cloud breaches. This is the complete map to keyless auth — how workload identity federation and OIDC replace static secrets everywhere, and where to start.

••2 months ago

Keyless Cloud Authentication — Ending Static Credentials Across AWS, GCP, and Azure

Long-lived access keys are the root cause behind most cloud breaches. This is the complete map to keyless auth — how workload identity federation and OIDC replace static secrets everywhere, and where to start.

Kiril Urbonas·4

Read article

We rotated a leaked AWS access key that a workflow had committed to logs. Switching GitHub Actions to OIDC federation meant no static AWS keys exist to leak in the first place.

••2 months ago

OIDC Federation for GitHub Actions to AWS: Killing Long-Lived Keys

We rotated a leaked AWS access key that a workflow had committed to logs. Switching GitHub Actions to OIDC federation meant no static AWS keys exist to leak in the first place.

Kiril Urbonas·11

Read article

We had long-lived AWS keys sitting in a datacenter we don't own. IAM Roles Anywhere let us delete every one of them. Here's the real setup.

••2 months ago

AWS IAM Roles Anywhere: Workloads Outside AWS Without Static Keys

We had long-lived AWS keys sitting in a datacenter we don't own. IAM Roles Anywhere let us delete every one of them. Here's the real setup.

Kiril Urbonas·5

Read article

OIDC federation between AWS, GCP, and CI providers let us delete every long-lived cloud credential we had. The setup, the gotchas, and the trust-relationship discipline.

••3 months ago

Cross-Cloud Identity Federation — Patterns That Replaced Our Long-Lived Keys

OIDC federation between AWS, GCP, and CI providers let us delete every long-lived cloud credential we had. The setup, the gotchas, and the trust-relationship discipline.

Kiril Urbonas·5

Read article