Workload Identity Instead of Static Keys

Try it out loud first. Then check yourself:

1. Workloads prove who they are with a short-lived signed token from their platform and exchange it for temporary cloud credentials.
2. CI: GitHub Actions can request an OIDC token that AWS accepts via AssumeRoleWithWebIdentity; no stored access key.
3. Scope the trust policy on token claims (repository, branch or environment), or any repository could assume the role.
4. In Kubernetes use IRSA or EKS Pod Identity, or SPIFFE/SPIRE across platforms; credentials then expire on their own.

If the interviewer pushes back

• A trust policy only checks the token audience. What can an attacker do, and how do you fix it?

Go deeper

• docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect
• spiffe.io/docs/latest/spiffe-about/overview/