Compliance Engineering Platform

Zero Trust Credential Elimination

Live

Identity and access

OIDC GCP WIF Zero Trust

Long-lived credentials are one of the leading causes of cloud breaches. An access key stored in a repository, exposed in an environment variable, or left in a CI/CD secret that never rotates is a breach waiting to happen. The credential does not expire. The attacker has as much time as they need.

This project eliminates long-lived credentials from the entire pipeline. GitHub Actions authenticates to AWS and GCP using OpenID Connect. Every credential is issued for a single workflow run, scoped to the minimum required permissions, and expires when the run ends. There are no keys to rotate, leak, or revoke.

Long-lived credentials in the pipeline

100%

Access decisions logged and auditable

Per-run

Credential scope. Expires when run ends.

Try it. Submit an access request.

Select a workflow scenario and watch the identity policy evaluate the request. Every decision is logged to the audit trail.

Validating OIDC token...

Recent access decisions

How it works

01

GitHub Actions requests an OIDC token

When a workflow runs, GitHub's OIDC provider issues a short-lived token containing verified claims about the workflow: repository, branch, environment, and run ID. No secrets stored anywhere.
02

AWS and GCP evaluate the token claims

The IAM role trust policy and GCP Workload Identity Federation binding both specify exactly which claims they accept. A token from the wrong branch, wrong repository, or wrong environment is rejected before any credentials are issued.
03

Short-lived credentials are issued for the run

If the claims match, AWS STS issues temporary credentials scoped to the minimum required permissions. They expire when the workflow run ends. A stolen token from a completed run is worthless.
04

Every decision is logged to CloudTrail

Every AssumeRoleWithWebIdentity call is logged. Every access decision, approved or denied, is in CloudTrail and auditable. The complete credential lifecycle for every workflow run is reconstructable.

Stack

OIDC GCP Workload Identity Federation AWS IAM AWS STS Cosign GitHub Actions CloudTrail

Part of the Compliance Engineering Platform, built from the GCP Workload Identity Federation and OIDC pipeline labs developed across 11 labs in the GRC Engineering program.

Changelog

Jul 6, 2026 Interactive demo launched. Three access scenarios live: approved deploy, denied fork PR, denied token replay.

Jul 6, 2026 GCP Workload Identity Federation binding scoped to production environment only. Non-production runs use a separate restricted binding.

Jul 5, 2026 IAM role trust policy updated to require branch claim in addition to repository. Feature branch deploys now require explicit approval.

Jul 3, 2026 CloudTrail alert added for any AssumeRoleWithWebIdentity call outside of expected workflow patterns.

↗ GitHub repo ← Back to platform ← All projects