Listen to this Post
Using long-lived cloud credentials poses significant security risks. Instead, leveraging temporary credentials through OpenID Connect (OIDC) provides a more secure approach by limiting credential validity periods. GitHub Actions supports OIDC integration with AWS, allowing secure role assumption and short-lived credential generation.
Jefferson Ferrari’s article explains how to configure OIDC between GitHub and AWS using Terraform, ensuring AWS validates requests from trusted GitHub sources before issuing credentials.
Read the full guide here: Github OpenID Connect with AWS and Terraform
You Should Know:
1. Setting Up OIDC Provider in AWS
To establish trust between GitHub and AWS, configure an OIDC provider in AWS IAM:
aws iam create-open-id-connect-provider \ --url https://token.actions.githubusercontent.com \ --client-id-list sts.amazonaws.com \ --thumbprint-list <GITHUB_OIDC_THUMBPRINT>
2. GitHub Actions Workflow for AWS Authentication
Use this GitHub Actions YAML snippet to assume an AWS role:
jobs: deploy: runs-on: ubuntu-latest permissions: id-token: write contents: read steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 with: role-to-assume: arn:aws:iam::123456789012:role/github-actions-role aws-region: us-east-1
3. Terraform for OIDC and IAM Role
Define the IAM role in Terraform:
resource "aws_iam_role" "github_actions" {
name = "github-actions-role"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Principal = {
Federated = "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
}
Action = "sts:AssumeRoleWithWebIdentity"
Condition = {
StringLike = {
"token.actions.githubusercontent.com:sub" = "repo:your-org/your-repo:"
}
}
}
]
})
}
4. AWS CLI for Temporary Credentials
After role assumption, retrieve temporary credentials:
aws sts assume-role-with-web-identity \ --role-arn arn:aws:iam::123456789012:role/github-actions-role \ --role-session-name github-actions \ --web-identity-token $(curl -s https://token.actions.githubusercontent.com)
5. Auditing OIDC Access
Monitor OIDC-based role assumptions using AWS CloudTrail:
aws cloudtrail lookup-events \ --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRoleWithWebIdentity \ --region us-east-1
What Undercode Say
OIDC integration between GitHub and AWS enhances security by eliminating long-term credentials. Key takeaways:
– Least Privilege: Restrict GitHub Actions roles to necessary permissions.
– Terraform Automation: Use IaC to enforce OIDC configurations.
– Audit Trails: Monitor `AssumeRoleWithWebIdentity` events in CloudTrail.
– Linux Security: Secure token handling using `jq` and `curl` in CI/CD pipelines.
Relevant Linux Commands
Extract token from OIDC response jq -r '.token' oidc-response.json Secure token storage export AWS_WEB_IDENTITY_TOKEN_FILE=$(mktemp /tmp/token.XXXXXX)
Windows Equivalent (PowerShell)
Retrieve OIDC token Invoke-RestMethod -Uri "https://token.actions.githubusercontent.com" | Select-Object -ExpandProperty token
Expected Output:
A secure, automated GitHub-to-AWS OIDC pipeline with temporary credentials and Terraform-managed IAM roles.
Prediction
OIDC will become the standard for CI/CD-to-cloud authentication, replacing static credentials in DevOps workflows.
References:
Reported By: Darryl Ruggles – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
