env zero now supports a v2 OIDC token format that issues a provider-specific aud (audience) claim for each cloud credential, instead of the same shared audience across AWS, Azure, GCP, and Vault. This prevents a token issued for one provider from being replayed against another, and lets you write cloud IAM trust policies that key off the audience claim.
What’s new
- Provider-specific token audiences for AWS, Azure, GCP, and Vault OIDC credentials, instead of one shared audience across all providers
- Use v2 OIDC token option on each OIDC credential (AWS, Azure, GCP, Vault), so you opt in per credential
- Existing v1 credentials keep working unchanged. v2 is opt-in, not a forced migration
How it works
- When creating or editing an OIDC credential, check Use v2 OIDC token to switch that credential to a provider-specific audience (for example,
sts.amazonaws.com for AWS).
- v2 tokens also drop the deprecated
https://env0.com/* claims. Use the client_id claim instead if you referenced those claims in trust policies.
- v1 credentials are unaffected until you opt them in.
Self-hosted agents need v5.2.0 or later. On an older agent, enabling v2 on a credential silently falls back to the v1 audience instead of failing, so confirm your agent version before you rely on the per-provider audience.
