liveBook · Manning

OIDC token

As explained in Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu

An OIDC token is a signed token carrying claims about an authenticated identity for use by a relying system.

An OIDC token carries claims about an authenticated workload. A continuous-delivery platform presents it to a cloud provider, which exchanges it for temporary credentials instead of requiring stored credentials, rotation, or service accounts. section 8.5.1

The provider must explicitly use OIDC. Spacelift exposes a token file for each run, while GitHub Actions makes the token available through workflow permissions; trust conditions should restrict access to the intended stack or workflow. section 8.5.1

Assuming an AWS role from Spacelift

Configure the AWS provider with an AWS role ARN and the automatically created token file: web_identity_token_file = "/mnt/workspace/spacelift.oidc". AWS exchanges the OIDC token for temporary credentials.

How Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu covers it

How deep it goes
Explains token exchange and platform configuration, then demonstrates AWS provider registration and role assumption.
Examples
Uses GitHub Actions permissions, Spacelift token files, AWS provider registration, and workflow role-assumption configurations.
What it assumes
Assumes a configured delivery platform and cloud-provider trust relationship, while demonstrating token access and provider settings.
What you can do after
Apply it via OIDC provider configuration to exchange a delivery-platform token for temporary cloud credentials.
How it connects
Connects OpenID Connect with continuous delivery, temporary credentials, AWS IAM, Terraform, GitHub Actions, and Spacelift.
Cover of Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu
liveBookmanning.com
Read Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu. The section links point to the parts of the book it draws on.