AWS OIDC Authentication with SPIFFE at Square
summary
Square extends SPIFFE to AWS by building an OIDC pipeline that exchanges SPIFFE JWTs for AWS creds using the open source spiffe-aws-assume-role tool, a SPIRE OIDC discovery provider, and a cron job that syncs JWKs to S3 + CloudFront. A Terraform module and a p2 hook auto-generate AWS credential files; JWTs are fetched from the local SPIRE agent and STS sessions default to one hour. Rollout is GA and teams migrate with minimal manual keys. 10 seconds
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:44AWS at Square
- 1:14What is OIDC?
- 2:19OIDC JWT
- 3:46OIDC in AWS
- 4:31Previous Method
- 5:31OIDC Method
- 6:34Architecture Overview
- 8:12SPIRE OIDC Discovery Provider
- 8:31P2 Hook
- 9:23SPIFFE OIDC Cron
- 10:21spiffe-aws assume-role
- 11:01Current Status
- 11:37More About Square Security Infra in AWS
related talks
34mDon't Mind the Gap: Securely Accessing Cloud Resources From Anywhere With SPIFFE/SPIRE
49mReal World SPIFFE Scenarios and Outcomes
36mFederated Identity for Distributed Systems: Understanding SPIFFE
28mCan I Trust You? Service-to-Service Identity with SPIFFE
32mFive Things You Didn’t Know You Could Do with SPIFFE and SPIRE
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
40mMulti-Cloud Workload Identity With SPIFFE