Identity between Flow and your cloud

Under Environments, click an environment and choose Secrets and keys; at the bottom, for owners only, is Cloud identity. Choose Show cloud identity. At the top are the issuer (the portal) and the subject, here org:de-wit-bikes/env:prod: the organisation and the environment. Every environment has a subject of its own, so Test can never reach Production's vault. None of this is secret.

For Azure Key Vault, the app registration that reads your vault gets a federated credential with exactly this issuer, this subject and the audience api://AzureADTokenExchange. The command for the Azure CLI is there, with this environment's values already filled in. The app gets no client secret.

For AWS Secrets Manager you add the portal as OpenID Connect provider and create a role. The trust policy lets in only a token with this subject and the audience sts.amazonaws.com; Flow assumes the role with AssumeRoleWithWebIdentity, without an access key.

For Google Cloud Secret Manager you create a workload identity pool with a provider for this environment. The condition lets in only this subject; then you give exactly that identity read access on the secrets. A service account key file is not needed.