Workload identity Federation
Introduction
Workload identity federation lets a credential authenticate to your cloud provider without storing a long-lived key or secret in Tines. Instead of an access key, service account key, or client secret, Tines signs a short-lived identity token for the credential and your provider exchanges it for its own short-lived access. You decide exactly which Tines credential your provider trusts, and you can revoke that trust at any time from the provider's side.
Workload identity federation is available for:
AWS, as the "Workload identity (OIDC)" authentication type of an AWS credential
Google Cloud, Microsoft Entra, and Oracle Cloud each have a connect flow that walks you through the setup. You can also create the credential manually and register the trust details yourself.
How it works
Your tenant acts as an OpenID Connect (OIDC) identity provider. When you create a credential, Tines shows you its trust details:
Issuer URL: a URL under your tenant, e.g.
https://example.tines.com/oidc/<id>. Your provider fetches Tines' public signing keys from this URL to verify tokens, so it must be reachable from the provider over HTTPS.Subject: a unique identifier for this credential, e.g.
credential:053d407c-923d-4795-ac92-b1084f5540af. Only this credential can present it. Every credential has its own subject, so each one is bound separately on the provider side, like the unique external ID on a role-based AWS credential.Audience: the value the provider expects in the token. Each provider has a recommended default, which Tines pre-fills.
You register these details with your provider, grant the resulting identity the access your stories need, and save the credential. Saving verifies the setup by exchanging a token with the provider, so a mistake in the binding surfaces immediately with the provider's error message.
Tokens Tines signs are valid for minutes, and the access your provider issues in return is short-lived. Tines renews it automatically before it expires; there is nothing to rotate on the Tines side. Tines rotates its signing keys automatically, and providers pick up new keys from the issuer URL.
Before you begin
You need permission to create credentials in the team, and administrator access to the provider (IAM in AWS or Google Cloud, an app registration in Microsoft Entra, or an identity domain in Oracle Cloud).
The provider must be able to reach your tenant's issuer URL over HTTPS. If you restrict access to your tenant by network, allow the provider to reach
https://<your tenant>/oidc/.Identity and access changes can take a minute to propagate at some providers. If verification fails straight after you granted access, wait briefly and save again.
Test credentials
A test credential has its own subject: the live credential's subject with a :test suffix. It is a separate identity, so register and grant it separately, typically to a non-production project, account, or app registration. Nothing granted to the live credential applies to the test credential, and the other way around.
Revoking access
Each credential is its own identity, so you can revoke one without affecting others: remove its binding at the provider (the pool grant, federated credential, trust, or role trust statement). Deleting the credential in Tines retires its subject permanently; it is never reused by another credential. Remove the provider-side binding as well to keep the provider's configuration tidy.
Troubleshooting
Audience does not match: the audience registered with the provider differs from the credential's audience field. Both must match exactly.
Subject not granted or unauthorized: the provider verified the token but nothing is bound to this subject. Check the pool grant, federated credential subject identifier, trust impersonation rule, or role trust policy, and remember that a test credential has its own
:testsubject.Issuer or keys could not be fetched: the provider can't reach the issuer URL. Check that your tenant is reachable from the provider over HTTPS.
Verification fails right after granting access: IAM changes can take a minute to propagate. Save again shortly.