OIDC federation lets a workflow authenticate to a cloud (AWS, Azure, GCP) with an ephemeral token issued by GitHub, without storing a durable access key as a secret. The cloud provider verifies the workflow's identity (repository, branch) before granting limited access.
Example
permissions:
id-token: write
contents: read