[Cheat Sheet] Zero-Trust CI/CD: OIDC & Ephemeral Secrets

In 2026, static CI/CD secrets (the infamous 'Forever Keys') are a legacy liability. OpenID Connect (OIDC) has become the gold standard for securing deployment pipelines by using ephemeral, short-lived identities. This cheat sheet provides a comprehensive reference for implementing Zero-Trust CI/CD across major providers.

1. Core OIDC Concepts

Before implementing, understand these three pillars of ephemeral identity:

• ID Token (JWT): A signed token issued by the CI/CD provider (e.g., GitHub) containing 'claims' about the job.
• Trust Policy: A configuration on the Cloud side (AWS/GCP/Azure) that defines which claims are allowed to assume a role.
• STS (Security Token Service): The cloud service that exchanges the JWT for short-lived credentials.

2. GitHub Actions + AWS Configuration

To use OIDC with GitHub Actions, you must update your workflow permissions to allow id-token: write.

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/my-github-role
          aws-region: us-east-1

3. GitLab CI + GCP Configuration

GitLab uses the id_tokens keyword to request a JWT for the GCP workload identity federation.

deploy-job:
  id_tokens:
    GCP_ID_TOKEN:
      aud: https://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID
  script:
    - echo "$GCP_ID_TOKEN" > .ci_job_jwt
    - gcloud iam workload-identity-pools create-cred-config ... --credential-source-file=.ci_job_jwt

4. CLI Command Cheat Sheet

5. Keyboard Shortcuts for Security Tooling

When auditing your OIDC setup, these system-wide shortcuts can speed up your workflow:

When dealing with sensitive logs during OIDC debugging, use the Data Masking Tool to scrub PII or accidental credential leaks before sharing diagnostics.

6. Advanced Hardening: Conditional OIDC

Don't just trust the repo; trust the environment or branch. Use ABAC (Attribute-Based Access Control) in your AWS Trust Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Federated": "arn:aws:iam::12345:oidc-provider/token.actions.githubusercontent.com" },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:techbytes/app:environment:production"
        }
      }
    }
  ]
}