Secret Stores and Short-Lived Credentials

Stop storing long-lived keys

A secret manager (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager) stores secrets encrypted, controls who can read each one, logs every access and supports rotation. Applications fetch secrets at runtime or receive them through the platform, for example as Kubernetes secrets synced from the manager. Better still is avoiding static secrets entirely. With OIDC federation, a CI system such as GitHub Actions issues a signed, short-lived identity token describing the job: repository, branch, workflow. The cloud provider is configured to trust that issuer and to exchange tokens matching specific claims for temporary credentials that expire within hours or less. Nothing long-lived is stored in CI, so there is nothing to leak or rotate. Dynamic secrets apply the same idea to databases: Vault can create a database user on request and delete it when the lease ends.

GitHub Actions: AWS access without stored keys

The job requests an OIDC token (id-token: write) and exchanges it for a temporary role session. The AWS role's trust policy should restrict which repository and branch may assume it.

name: deploy
on:
  push:
    branches: [main]
permissions:
  id-token: write   # allow requesting the OIDC token
  contents: read
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/gh-deploy
          aws-region: ap-south-1
      - run: aws sts get-caller-identity

Hotel key cards

A hotel does not hand guests a master key. The front desk checks your identity and issues a card that opens one room and stops working at checkout. OIDC federation is the front desk; the temporary credential is the key card.

Scope the trust policy

An OIDC trust that accepts any repository in the organisation, or any branch, lets a workflow on an unreviewed feature branch, or in an unrelated repository, assume your production deploy role. Match the sub claim to the exact repository and branch or environment.

Quick check: What is the main security benefit of OIDC federation for CI?

• No long-lived cloud credentials are stored in the CI system
• Builds become faster
• It encrypts the source code
• It removes the need for IAM roles