45. What’s the magic of OIDC identity providers?
AWS Bites14 Jul 2022

45. What’s the magic of OIDC identity providers?

If you are thinking of using an external CICD tool to deploy to AWS you are probably wondering how to securely connect your pipelines to your AWS account.

You could create a user for your CICD tool of choice and copy some hard coded credentials into it, but, let’s face it: this doesn’t feel like the right - or at least the most secure - approach!

In the previous episode we discussed how AWS and GitHub solved this problem by using OIDC identity providers and this seems to be a good solution to the problem.

In this episode of AWS Bites we will try to demystify the secrets of OIDC identity providers and explain how they work and what’s the trust model between AWS and an OIDC provider like GitHub actions. We will also explain all the steps required to integrate AWS with GitHub, how JWT works in this particular scenario and other use cases where you could use OIDC providers.

In this episode, we mentioned the following resources:

- GitHub docs explaining how to integrate with AWS as an OIDC provider: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect

- Article “What’s in a JWT” https://loige.co/whats-in-a-jwt

- jwtinfo, CLI tool to inspect JWT: https://github.com/lmammino/jwtinfo

- AWS action to assume a role from a GitHub Pipeline: https://github.com/aws-actions/configure-aws-credentials#assuming-a-role

- Great post by Elias Brange detailing how to setup GitHub OIDC integration for AWS: https://www.eliasbrange.dev/posts/secure-aws-deploys-from-github-actions-with-oidc/

- Previous episode on why you should consider GitHub Actions rather than AWS CodePipeline: https://awsbites.com/44-do-you-use-codepipeline-or-github-actions/

This episode is also available on YouTube: https://www.youtube.com/AWSBites

You can listen to AWS Bites wherever you get your podcasts. See https://awsbites.com for all the links.

Do you have any AWS questions you would like us to address?

Connect with us on Twitter:
- https://twitter.com/eoins
- https://twitter.com/loige


Episoder(156)

152. Exploring Lambda Durable Functions

152. Exploring Lambda Durable Functions

AWS Lambda is fantastic for small, stateless code on demand. But when your “function” starts looking like a workflow (retries, backoff, long waits, human approvals, callbacks), classic Lambda patterns...

6 Feb 48min

151. EC2 ❤️ Lambda - Lambda Managed Instances

151. EC2 ❤️ Lambda - Lambda Managed Instances

AWS just made Lambda… less serverless. Lambda Managed Instances (Lambda MI) brings managed EC2 capacity into Lambda, and it changes the rules: environments stay warm, a single environment can handle m...

16 Jan 35min

150. Exploring All-New ECS Managed Instances (MI) Mode

150. Exploring All-New ECS Managed Instances (MI) Mode

Love AWS Fargate, but occasionally hit the “I need more control” wall (GPUs, storage, network bandwidth, instance sizing)? In this episode of AWS Bites, Eoin and Luciano put the brand-new Amazon ECS M...

28 Nov 202526min

149. Headless CMS on AWS

149. Headless CMS on AWS

We dive deep into Strapi, an open-source headless CMS that's changing how we approach content management and CRUD applications. In this episode, we explore how Strapi separates content from presentati...

18 Sep 202533min

148. Lambda and Java with Mark Sailes

148. Lambda and Java with Mark Sailes

What if “Java is too old for serverless” is the myth holding your team back in 2025?We put it to the test with Mark Sailes (ex-AWS, Java-on-Lambda expert). In this AWS Bites episode we get specific: w...

4 Sep 202546min

147. Spec coding with Kiro

147. Spec coding with Kiro

What if AWS built an IDE to rival your favorite editor? Turns out they did!In this episode of AWS Bites, we dive into Kiro, an AI centric fork of VS Code that tries to turn an empty repo and a loose i...

21 Aug 202538min

146. The AWS Product Lifecycle page

146. The AWS Product Lifecycle page

What if AWS had its own version of Killed by Google? Well… turns out it kind of does.In this episode of AWS Bites, we explore the AWS Product Lifecycle page, the official place where AWS quietly lists...

10 Jul 202515min

145. We Tried Amazon DSQL So You Don’t Have To (But You Might Want To)

145. We Tried Amazon DSQL So You Don’t Have To (But You Might Want To)

Amazon Aurora DSQL promises to bring a truly serverless experience to SQL databases. But does it actually deliver? In this episode of AWS Bites, we put Aurora DSQL to the test. We explore what makes i...

26 Jun 202528min

Populært innen Teknologi

romkapsel
rss-avskiltet
tomprat-med-gunnar-tjomlid
teknisk-sett
nasjonal-sikkerhetsmyndighet-nsm
energi-og-klima
rss-impressions-2
shifter
elektropodden
lydartikler-fra-aftenposten
fornybaren
hans-petter-og-co
smart-forklart
pedagogisk-intelligens
rss-alt-vi-kan
rss-ki-praten
rss-fish-ships
rss-tendencast-kunstig-intelligens-og-juss-2
rss-heis
rss-for-alarmen-gar