Including the CircleCI context names on the OpenID Connect subject standard claim would allow users to establish more granular trust conditions; i.e. only authorize jobs that use a specific context.
Currently, CircleCI OpenID Connect tokens include an additional claim (oidc.circleci.com/context-ids) with this information, but AWS only supports conditions based on standard claims.
GitHub Actions, for example, includes the name of the environment as part of the subject claim. On the other hand, GitLab CI/CD doesn't.
Example of the desired subject claim format:
org/<organization-id>/project/<project-id>/user/<user-id>/context/<context-name>
Not sure about the best way of specifying multiple contexts, though.
Related