Comparison
Identity federationvsRole assumption
Identity federation
the pipeline authenticates to the cloud with a signed token from its own provider, so there is no stored key at all.
Trusting an external identity provider's assertions instead of issuing your own credentials, whether for people through single sign-on or for pipelines through short-lived signed tokens. It removes the last static keys from delivery systems, which is the single highest-value credential improvement most organisations can make. The subject condition on the trust matters enormously: federating a whole provider rather than a specific repository and branch is a well-known hole.
Full entry →Role assumption
your pipeline swaps its own identity for a short-lived role in the target account, and that swap is logged.
Exchanging one identity for temporary credentials under a different role, typically to cross an account or trust boundary. It is the standard way to avoid storing credentials for other environments, and it makes the trust relationship explicit and auditable. The trust policy on the target role is the real control — an over-broad one lets anything in the source account assume it, which is how one team's compromise becomes another's.
Full entry →