OIDC Provider

Firefly can authenticate to your cloud provider using OpenID Connect (OIDC) instead of long-lived static credentials. At execution time Firefly issues a short-lived OIDC token, your cloud provider exchanges it for temporary credentials, and the run proceeds under an identity you control. No static cloud key is ever stored by Firefly.

Setup always has two parts: registering Firefly as an identity provider in your cloud account, then enabling OIDC on the Firefly project or workspace.

Choose your cloud provider

• Amazon Web Services (AWS) — register Firefly as an IAM identity provider and assume an IAM role via web identity.

• Google Cloud — register Firefly as an OIDC provider in a workload identity pool and impersonate a service account via Workload Identity Federation.

Where OIDC is configured in Firefly

For both providers, OIDC can be enabled at either level:

• Project level — an inherited attribute. All sub-projects and workspaces within the project pick up the same authentication configuration.

• Workspace level — configured per workspace under Workspace Configuration → Runner Configuration, and overrides what the project provides.

Each provider guide covers the specific values you need to enter.