📄 YAMLmedium

2. Keyless cloud auth with OIDC

In a GitHub Actions workflow, grant the MINIMUM permissions for keyless cloud auth via OIDC (no stored cloud keys). Write a `permissions:` block with: • id-token: write (lets the job mint an OIDC token) • contents: read

How to approach this

OIDC workload-identity federation lets a CI job present a short-lived, signed token that the cloud trusts and exchanges for TEMPORARY credentials — so you store NO long-lived cloud access keys anywhere (the single most-leaked secret). `id-token: write` is the permission that lets the job request that OIDC token; everything else stays least-privilege (`contents: read`). The cloud side is configured to trust your repo/branch.

config.yaml