Sign your own binaries with go-tool-base, part 3: keyless CI signing with OIDC
Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.
Tags
3 pages
Oidc
A 403 you can't fix in IAM
A GitLab to AWS OIDC trust policy kept returning 403, and no IAM change fixed it: the policy matched a claim GitLab never actually asserts.
No access keys in CI
Replacing long-lived AWS access keys in CI with OIDC federation, so the pipeline mints a short-lived token instead of holding a secret.
