--- a/taskcluster/taskgraph/morph.py
+++ b/taskcluster/taskgraph/morph.py
@@ -14,16 +14,17 @@ the graph.
 # Note that the translation of `{'task-reference': '..'}` is handled in the
 # optimization phase (since optimization involves dealing with taskIds
 # directly).  Similarly, `{'relative-datestamp': '..'}` is handled at the last
 # possible moment during task creation.
 
 from __future__ import absolute_import, print_function, unicode_literals
 
 import logging
+import re
 
 from slugid import nice as slugid
 from .task import Task
 from .graph import Graph
 from .taskgraph import TaskGraph
 
 logger = logging.getLogger(__name__)
 MAX_ROUTES = 10
@@ -89,30 +90,52 @@ def derive_misc_task(task, purpose, imag
         dependencies['docker-image'] = image_taskid
 
     task = Task(kind='misc', label=label, attributes={}, task=task_def,
                 dependencies=dependencies)
     task.task_id = slugid()
     return task
 
 
+# these regular expressions capture route prefixes for which we have a star
+# scope, allowing them to be summarized.  Each should correspond to a star scope
+# in each Gecko `assume:repo:hg.mozilla.org/...` role.
+SCOPE_SUMMARY_REGEXPS = [
+    re.compile(r'(index:insert-task:buildbot\.branches\.[^.]*\.).*'),
+    re.compile(r'(index:insert-task:buildbot\.revisions\.).*'),
+    re.compile(r'(index:insert-task:docker\.images\.v1\.[^.]*\.).*'),
+    re.compile(r'(index:insert-task:gecko\.v2\.[^.]*\.).*'),
+]
+
+
 def make_index_task(parent_task, taskgraph, label_to_taskid):
     index_paths = [r.split('.', 1)[1] for r in parent_task.task['routes']
                    if r.startswith('index.')]
     parent_task.task['routes'] = [r for r in parent_task.task['routes']
                                   if not r.startswith('index.')]
 
     task = derive_misc_task(parent_task, 'index-task', 'index-task',
                             taskgraph, label_to_taskid)
-    task.task['scopes'] = [
-        'index:insert-task:{}'.format(path) for path in index_paths]
+
+    # we need to "summarize" the scopes, otherwise a particularly
+    # namespace-heavy index task might have more scopes than can fit in a
+    # temporary credential.
+    scopes = set()
+    for path in index_paths:
+        scope = 'index:insert-task:{}'.format(path)
+        for summ_re in SCOPE_SUMMARY_REGEXPS:
+            match = summ_re.match(scope)
+            if match:
+                scope = match.group(1) + '*'
+                break
+        scopes.add(scope)
+    task.task['scopes'] = sorted(scopes)
+
     task.task['payload']['command'] = ['insert-indexes.js'] + index_paths
-    task.task['payload']['env'] = {
-        "TARGET_TASKID": parent_task.task_id,
-    }
+    task.task['payload']['env'] = {"TARGET_TASKID": parent_task.task_id}
     return task
 
 
 def add_index_tasks(taskgraph, label_to_taskid):
     """
     The TaskCluster queue only allows 10 routes on a task, but we have tasks
     with many more routes, for purposes of indexing. This graph morph adds
     "index tasks" that depend on such tasks and do the index insertions

new file mode 100644
--- /dev/null
+++ b/taskcluster/taskgraph/test/test_morph.py
@@ -0,0 +1,86 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+import unittest
+
+from .. import morph
+from ..graph import Graph
+from ..taskgraph import TaskGraph
+from ..task import Task
+
+from mozunit import main
+
+
+class TestIndexTask(unittest.TestCase):
+
+    def test_make_index_tasks(self):
+        task_def = {
+            'routes': [
+                "index.gecko.v2.mozilla-central.latest.firefox-l10n.linux64-opt.es-MX",
+                "index.gecko.v2.mozilla-central.latest.firefox-l10n.linux64-opt.fy-NL",
+                "index.gecko.v2.mozilla-central.latest.firefox-l10n.linux64-opt.sk",
+                "index.gecko.v2.mozilla-central.latest.firefox-l10n.linux64-opt.sl",
+                "index.gecko.v2.mozilla-central.latest.firefox-l10n.linux64-opt.uk",
+                "index.gecko.v2.mozilla-central.latest.firefox-l10n.linux64-opt.zh-CN",
+                "index.gecko.v2.mozilla-central.pushdate."
+                "2017.04.04.20170404100210.firefox-l10n.linux64-opt.es-MX",
+                "index.gecko.v2.mozilla-central.pushdate."
+                "2017.04.04.20170404100210.firefox-l10n.linux64-opt.fy-NL",
+                "index.gecko.v2.mozilla-central.pushdate."
+                "2017.04.04.20170404100210.firefox-l10n.linux64-opt.sk",
+                "index.gecko.v2.mozilla-central.pushdate."
+                "2017.04.04.20170404100210.firefox-l10n.linux64-opt.sl",
+                "index.gecko.v2.mozilla-central.pushdate."
+                "2017.04.04.20170404100210.firefox-l10n.linux64-opt.uk",
+                "index.gecko.v2.mozilla-central.pushdate."
+                "2017.04.04.20170404100210.firefox-l10n.linux64-opt.zh-CN",
+                "index.gecko.v2.mozilla-central.revision."
+                "b5d8b27a753725c1de41ffae2e338798f3b5cacd.firefox-l10n.linux64-opt.es-MX",
+                "index.gecko.v2.mozilla-central.revision."
+                "b5d8b27a753725c1de41ffae2e338798f3b5cacd.firefox-l10n.linux64-opt.fy-NL",
+                "index.gecko.v2.mozilla-central.revision."
+                "b5d8b27a753725c1de41ffae2e338798f3b5cacd.firefox-l10n.linux64-opt.sk",
+                "index.gecko.v2.mozilla-central.revision."
+                "b5d8b27a753725c1de41ffae2e338798f3b5cacd.firefox-l10n.linux64-opt.sl",
+                "index.gecko.v2.mozilla-central.revision."
+                "b5d8b27a753725c1de41ffae2e338798f3b5cacd.firefox-l10n.linux64-opt.uk",
+                "index.gecko.v2.mozilla-central.revision."
+                "b5d8b27a753725c1de41ffae2e338798f3b5cacd.firefox-l10n.linux64-opt.zh-CN"
+            ],
+            'deadline': 'soon',
+            'metadata': {
+                'description': 'desc',
+                'owner': 'owner@foo.com',
+                'source': 'https://source',
+            },
+        }
+        task = Task(kind='test', label='a', attributes={}, task=task_def)
+        docker_task = Task(kind='docker-image', label='build-docker-image-index-task',
+                           attributes={}, task={})
+        taskgraph, label_to_taskid = self.make_taskgraph({
+            task.label: task,
+            docker_task.label: docker_task,
+        })
+
+        index_task = morph.make_index_task(task, taskgraph, label_to_taskid)
+
+        self.assertEqual(index_task.task['payload']['command'][0], 'insert-indexes.js')
+        self.assertEqual(index_task.task['payload']['env']['TARGET_TASKID'], 'a-tid')
+
+        # check the scope summary
+        self.assertEqual(index_task.task['scopes'],
+                         ['index:insert-task:gecko.v2.mozilla-central.*'])
+
+    def make_taskgraph(self, tasks):
+        label_to_taskid = {k: k + '-tid' for k in tasks}
+        for label, task_id in label_to_taskid.iteritems():
+            tasks[label].task_id = task_id
+        graph = Graph(nodes=set(tasks), edges=set())
+        taskgraph = TaskGraph(tasks, graph)
+        return taskgraph, label_to_taskid
+
+if __name__ == '__main__':
+    main()