A deployment runner needs permission to change the systems it manages. For a cloud provider, that usually means credentials: sensitive information used to authenticate the runner. Access also requires a network path to the target, especially in a private cloud. section 8.2.4
Do not put provider credentials or service API keys in Git, even in a trusted team. Anyone with repository access may obtain them, and a cloned repository can travel beyond your control. section 8.5
OpenID Connect (OIDC) offers a way to avoid storing long-lived deployment credentials:
- Configure the provider to trust the deployment platform’s OIDC identity, with conditions that limit which workload can gain access. section 8.5.1
- Let a deployment run exchange its OIDC token for temporary credentials. Some platforms require explicit provider configuration rather than a ready-made authentication action. section 8.5.1
Listing 8.14 Allowing a GitHub Actions workflow to assume a role
jobs:
terraform:
name: Run Terraform against AWS
runs-on: ubuntu-latest
permissions: #1
id-token: write #1
contents: read #1
steps:
- name: Checkout #2
uses: actions/checkout@v4
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4 #3
with:
role-to-assume: arn:aws:iam::999999999999:role/github-actions-${{
github.repository }} #4
region: us-west-2 #5
#1 The AWS action needs the OIDC token to be accessible.
#2 Checkout our repository.
#3 This action is published by AWS and converts the OIDC token into AWS credentials.
#4 When using OIDC you have to tell AWS what role you want to assume.
#5 AWS requires a region when logging in.
The GitHub Actions workflow grants access to an OIDC token, then uses the AWS credentials action to assume a specified role. section 8.5.1
Listing 8.15 Allowing a Spacelift stack to assume a role
variable "aws_role_arn" {
type = string
description = "The AWS Role to assume."
}
provider "aws" {
assume_role_with_web_identity {
role_arn = var.aws_role_arn
web_identity_token_file = "/mnt/workspace/spacelift.oidc" #1
}
}
The Spacelift example instead configures the Terraform AWS provider to assume a role using the OIDC token file created for the run. section 8.5.1
Temporary credentials reduce the need to store secrets, rotate persistent credentials, and manage service-user accounts. They do not solve network access. Once a system generates credentials, test that they actually function rather than merely checking that input values reached a resource. section 8.5.1 section 8.2.4 section 9.1.1
