liveBook · Manning

Identity and access management role

As explained in Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu

An identity and access management role is a cloud-defined set of permissions that an identity can assume.

Authentication establishes that an identity is valid; authorization determines what it may do. In AWS, an identity and access management role supplies that authorization to an identity provided by an external OpenID Connect identity provider. section 8.5.1

A secure role configuration should:

  • Trust the intended identity provider, such as GitHub Actions or Spacelift. section 8.5.1
  • Restrict assumption with conditions covering the specific repository, workflow, or Spacelift stack. section 8.5.1
  • Grant only the permissions required by the deployment workload. section 8.5.1

GitHub Actions assuming an AWS role

A workflow requests an OIDC token, checks out the repository, and uses aws-actions/configure-aws-credentials with a role ARN and AWS region. The role's trust policy must limit assumption to the intended repository and workflows. section 8.5.1

How Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu covers it

How deep it goes
Explains role trust and restrictive conditions through AWS, GitHub Actions, and Spacelift configurations, but not permission policies in detail.
Examples
Uses GitHub Actions and Spacelift workflows, AWS role ARNs, OIDC providers, and Terraform provider configuration.
What it assumes
Assumes familiarity with an external identity provider and distinguishes authentication from authorization before configuring cloud access.
What you can do after
Operate/configure AWS deployments by allowing a specified GitHub Actions workflow or Spacelift stack to assume a role.
How it connects
Connects authentication, authorization, OpenID Connect, identity providers, service principals, and web identity federation.
Cover of Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu
liveBookmanning.com
Read Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu. The section links point to the parts of the book it draws on.