Exchange a Vercel Function's OIDC token for short-lived AWS or GCP credentials without storing long-lived cloud secrets

Documented steps

1. In the Vercel project's Settings > Security, choose an OIDC issuer mode: Team (recommended, issuer https://oidc.vercel.com/[TEAM_SLUG]) or Global (https://oidc.vercel.com).
2. Know how the token is delivered: during Builds it's set to env var VERCEL_OIDC_TOKEN; inside a Vercel Function it's set on the x-vercel-oidc-token request header (cached up to 45 min, 60-min TTL); locally, run `vercel link` then `vercel env pull` to write VERCEL_OIDC_TOKEN into .env.local.
3. For AWS: in IAM > Identity Providers, add an OIDC provider with Provider URL https://oidc.vercel.com/[TEAM_SLUG] and Audience https://vercel.com/[TEAM_SLUG]; create an IAM role with a trust policy using Principal.Federated=arn:aws:iam::ACCOUNT_ID:oidc-provider/oidc.vercel.com/[TEAM_SLUG] and Condition StringEquals on the sub claim, e.g. owner:[TEAM_SLUG]:project:[PROJECT]:environment:production.
4. Store the role ARN as env var AWS_ROLE_ARN in the Vercel project. Install @aws-sdk/client-* plus @vercel/oidc-aws-credentials-provider, then pass credentials: awsCredentialsProvider({ roleArn: process.env.AWS_ROLE_ARN, audience: 'sts.amazonaws.com' }) to the AWS SDK client — this calls sts:AssumeRoleWithWebIdentity under the hood.
5. Also set AWS_REGION explicitly as a project env var — Vercel auto-sets AWS_REGION to the function's execution region, which is unstable across multi-region routing/failover and can point at the wrong region for your AWS resources.
6. For GCP: in IAM & Admin > Workload Identity Federation, create a Pool and an OIDC provider with Issuer URL https://oidc.vercel.com/[TEAM_SLUG] and either the default GCP-generated audience or Allowed audience https://vercel.com/[TEAM_SLUG]; map google.subject to assertion.sub.
7. Create a GCP service account, grant it the needed IAM role(s), then grant the Workload Identity principal (principal://iam.googleapis.com/.../subject/owner:[TEAM]:project:[PROJECT]:environment:[ENV]) the Service Account Token Creator/user role.
8. In code, install @vercel/oidc + google-auth-library, build google-auth-library's ExternalAccountClient with subject_token_supplier.getSubjectToken = getVercelOidcToken (or a wrapper passing a custom audience), pointing token_url at https://sts.googleapis.com/v1/token and service_account_impersonation_url at the GCP service account.
9. Official docs verified: https://vercel.com/docs/oidc/aws | https://vercel.com/docs/oidc/gcp | Reference: https://vercel.com/docs/oidc