Federation trust

Properties: X Secret rotation is cheap, V Named secrets, least privilege
Goal: TODO
Done when: TODO
Restart from: lesson 6 (the lesson whose checkpoint to reload if this one breaks)
Mode: self-paced or live · about 30 min

closes P12

Watch

TODO: video

hands-on self-paced live

Trust for CI OIDC, Kubernetes service accounts and SPIFFE is the assume_role_policy of each role plus aws_iam_openid_connect_provider resources under access/identity/, issuer and audience pinned and no wildcard sub claim. These carry the strictest checks and the highest drift severity in the repo. The repo never operates an issuer. Roles Anywhere is one paragraph, the option for a fleet with an existing PKI (decision 39).
Credentials are short-lived everywhere. The rotation check for the few static secrets that remain runs on the same weekday schedule as the watch, so one cron drives both and lesson 13 teaches the schedule once.
The agent sandbox is never a federation subject (decision 15).

TODO: Video script or link. Optional.

TODO: Numbered steps. Imperative. One job.

TODO: What Floci or your own machine can and cannot show.

TODO: What the room sees. Timing. The line to say.