Platform & DevOps·Secrets, identity and the supply chain
the pipeline authenticates to the cloud with a signed token from its own provider, so there is no stored key at all.
Identity federation
Also calledOIDC federation, workload identity federation, SSO federation
Trusting an external identity provider's assertions instead of issuing your own credentials, whether for people through single sign-on or for pipelines through short-lived signed tokens. It removes the last static keys from delivery systems, which is the single highest-value credential improvement most organisations can make. The subject condition on the trust matters enormously: federating a whole provider rather than a specific repository and branch is a well-known hole.