From a6286331cedd6bebbc00b73534b42539f7d28e30 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Thu, 16 Jan 2025 15:32:08 +0100 Subject: [PATCH] Add note about cloud services for shot-lived access Co-authored-by: Kerry Carmichael --- snippets/note-about-creating-tokens.adoc | 1 + 1 file changed, 1 insertion(+) diff --git a/snippets/note-about-creating-tokens.adoc b/snippets/note-about-creating-tokens.adoc index 158b14bf1ca8..871741a439df 100644 --- a/snippets/note-about-creating-tokens.adoc +++ b/snippets/note-about-creating-tokens.adoc @@ -10,4 +10,5 @@ * To prevent privilege escalation, when you create a new token, your role's permissions limit the permission you can assign to that token. For example, if you only have `read` permission for the Integration resource, you cannot create a token with `write` permission. * If you want a custom role to create tokens for other users to use, you must assign the required permissions to that custom role. * Use short-lived tokens for machine-to-machine communication, such as CI/CD pipelines, scripts, and other automation. Also, use the `roxctl central login` command for human-to-machine communication, such as `roxctl` CLI or API access. +* The majority of cloud service providers support OIDC identity tokens, for example, Microsoft Entra ID, Google Cloud Identity Platform, and AWS Cognito. OIDC identity tokens issued by these services can be used for {product-title-short} short-lived access. ====