Pipeline scoped OIDC enhanced subject
complete
G
Ginger Wildebeest
In order to adhere to the principal of least privilege, we would like to see an extension of the currently supported Enhanced Subject feature (as it pertains to OIDC authentication) to include the execution environment details, i.e the pipeline ID.
Today, project level resources look like:
account/<account_id>:org/{organization_id}:project/<project_id>
An extension of this would be:
account/<account_id>:org/{organization_id}:project/<project_id>:pipeline/<pipeline_id>
Alternatively, if extending custom parameters is more appropriate that is also fine as long as the goal of least privilege can be achieved.
Log In
Rohan Gupta
complete
FF: CDS_ENABLE_PIPELINE_SCOPED_OIDC_SUB
Delegate Version: 845xx
NOTE FOR AWS:
If you already use our AWS OIDC Auth option, you will need to update your policies after enabling the flag. This will now pass the pipeline id in the payload.
This post was marked as
in progress
Rohan Gupta
long-term
Rohan Gupta
This is on our roadmap for OIDC, adding the companies to the request.