Quartz 5

secretless-pipeline-authentication

Properties2
tagssecurity, pipelines, oidc, workload-identity
aliasesOIDC pipeline authentication, federated credentials

2 min read

Secretless pipeline authentication

What it is

Secretless pipeline authentication uses a short-lived identity token, commonly OpenID Connect (OIDC) workload identity federation, instead of storing a long-lived cloud credential in the CI/CD platform.

Why it exists

Long-lived client secrets and certificates can leak through logs, repositories, backups, or overly broad secret stores. Federation lets Azure evaluate the workload identity and trust conditions at token exchange time.

Key ideas

  • Configure trust on both sides: the workflow/pipeline identity issues a token, and Microsoft Entra ID accepts it only for the defined issuer, subject, audience, and application identity.
  • Grant the resulting service principal only the Azure role and scope required for the deployment.
  • A secretless path still needs authorization design. Removing a stored secret does not turn Contributor at subscription scope into least privilege.
  • Use managed identities for Azure-hosted workloads when the workload can obtain an Azure identity directly; use federation for external or CI/CD workload identity where appropriate.

Exam decision

Prefer OIDC/workload identity federation when a GitHub Actions or Azure Pipeline deployment must access Azure without a stored long-lived credential. Use Key Vault for secrets that cannot be eliminated, not as an excuse to retain unnecessary secrets.

workload-identity-federation · service-principal · managed-identity · key-vault

Source: Configure OpenID Connect in Azure for GitHub Actions

Graph View

Backlinks