Identity Examples on

Create an Assumable Identity for a GitHub Actions Workflow

Thu, 04 May 2023 08:48:45 +0000

Chainguard’s assumable identities are identities that can be assumed by external applications or workflows in order to perform certain tasks that would otherwise have to be done by a human. For instance, an assumable identity can be used to allow a GitHub Actions workflow to pull images from cgr.dev without a static pull token.

This tutorial outlines how to create an identity, and then create a GitHub Actions workflow that will assume the identity to interact with Chainguard resources.

Create an Assumable Identity for a GitLab CI/CD Pipeline

Wed, 28 Jun 2023 08:48:45 +0000

Chainguard’s assumable identities are identities that can be assumed by external applications or workflows in order to perform certain tasks that would otherwise have to be done by a human.

This procedural tutorial outlines two methods for how to create a Chainguard identity: chainctl and Terraform. It then walks through how to create a GitLab CI/CD pipeline that will assume the identity to interact with Chainguard resources.

Prerequisites

To complete this guide, you will need the following.

Create an Assumable Identity to Authenticate from Azure

Fri, 15 May 2026 00:00:00 +0000

Note: If you’re authenticating from a workload running in Azure Kubernetes Service (AKS), refer to the Kubernetes identity guide instead.

Chainguard’s assumable identities are identities that can be assumed by external applications or workflows in order to perform certain tasks that would otherwise have to be done by a human.

This procedural tutorial outlines how to create an identity that can be assumed by an Azure workload — such as a VM, Container App, or Function — using an Azure managed identity and then used to interact with the Chainguard API.

Create an Assumable Identity to Authenticate from AWS

Mon, 05 Jan 2026 09:00:00 +0000

Chainguard’s assumable identities are identities that can be assumed by external applications or workflows in order to access Chainguard resources or perform certain actions.

This tutorial outlines how to create a Chainguard identity that can be assumed by an AWS IAM user or IAM role using AWS IAM outbound identity federation.

Prerequisites

To complete this guide, outbound identity federation must be enabled for your AWS account. Follow the official AWS documentation to set this up.

Create an Assumable Identity to Authenticate from AWS (Legacy)

Fri, 28 Nov 2025 16:00:00 +0000

Note: This page describes a custom implementation of assumable identities for AWS that was developed before AWS natively supported issuing OIDC tokens with IAM outbound identity federation. If possible, you should follow the instructions on this page instead.

Chainguard’s assumable identities are identities that can be assumed by external applications or workflows in order to access Chainguard resources or perform certain actions.

This tutorial outlines how to create a Chainguard identity that can be assumed by an AWS user or IAM role and used to authorize requests from AWS services and workloads hosted on platforms like EC2, ECS, Lambda, and EKS.

Create an Assumable Identity for a Kubernetes Pod

Thu, 07 Aug 2025 13:00:00 +0000

Chainguard’s assumable identities are identities that can be assumed by external applications or workflows in order to perform certain tasks that would otherwise have to be done by a human.

This procedural tutorial outlines how to create an identity that can be assumed by a Kubernetes pod and then used to interact with the Chainguard API.

Prerequisites

To complete this guide, you will need the following.

Create an Assumable Identity for a Buildkite Pipeline

Wed, 17 May 2023 08:48:45 +0000

Chainguard’s assumable identities are identities that can be assumed by external applications or workflows in order to perform certain tasks that would otherwise have to be done by a human.

This tutorial outlines how to create an identity using Terraform, and then how to update a Buildkite pipeline so that it can assume the identity and interact with Chainguard resources.

Prerequisites

To complete this guide, you must have the following in place:

Create an Assumable Identity for a Bitbucket Pipeline

Wed, 17 May 2023 08:48:45 +0000

Chainguard’s assumable identities are identities that can be assumed by external applications or workflows in order to perform certain tasks that would otherwise have to be done by a human.

This procedural tutorial outlines how to create an identity using Terraform, and then how to update a Bitbucket pipeline so that it can assume the identity and interact with Chainguard resources.

Prerequisites

To complete this guide, you will need the following.

Use chainctl to Create an Assumable Identity for a Jenkins Pipeline

Sun, 07 Sep 2025 08:48:45 +0000

Jenkins is an open source automation server that supports building, deploying, and automating projects.

This guide explains how to use chainctl to create an assumable identity and configure Jenkins to use that identity to authenticate to Chainguard. To accomplish this, create an OIDC token credential in Jenkins and a matching Chainguard identity that uses the Jenkins OIDC URL, then put the process into an example Jenkins build pipeline.

To do this using Terraform, follow the instructions in Use Terraform to Create an Assumable Identity for a Jenkins Pipeline.

Use Terraform to Create an Assumable Identity for a Jenkins Pipeline

Sun, 07 Sep 2025 08:48:45 +0000

Chainguard’s assumable identities are identities that can be assumed by external applications or workflows in order to perform certain tasks that would otherwise have to be done by a human.

This procedural tutorial outlines how to create an identity using Terraform, and then how to update a Jenkins pipeline so that it can assume the identity and interact with Chainguard resources. If you would like to follow this guide using chainctl, Chainguard’s command line tool, you can review Use chainctl to Create an Assumable Identity for a Jenkins Pipeline.

Create an Assumable Identity for a CLI session authenticated with Keycloak

Tue, 26 Mar 2024 08:48:45 +0000

Chainguard’s assumable identities are identities that can be assumed by external applications or workflows in order to perform certain tasks that would otherwise have to be done by a human.

This procedural tutorial outlines how to create an identity using Terraform, and then assume the identity with the CLI to interact with Chainguard resources.

Prerequisites

To complete this guide, you will need the following.