Docker and CI/CD · Senior · Question 34 of 75
An OIDC trust policy allows any workflow in the org to assume the production role. What's the risk?
- 1OIDC tokens can't be used for the cloud at all
- ✓Correct answer: Any repo or branch could deploy to production
- 3Tokens expire too quickly for long deploys
Explanation
Restrict the sub claim to the specific repository and protected branch or environment, so only the reviewed deploy job gets credentials.