OIDC and CICD: Why Your CI Pipeline Is Your Greatest Security Threat
summary
Claim: CI pipelines hold long-lived credentials that leak and become the largest attack surface, so replace static tokens with OIDC tokens and tie them to cloud roles. Demonstrates using GitHub/GitLab OIDC -> AWS STS (audience must be sts.amazonaws.com) via AWS GitHub Action and an assume-role-with-web-identity trust policy. Recommends separating prod vs dev roles, few roles not many, and cites CircleCI guidance after a breach to rotate all secrets; demo code and repo links are provided.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:15CI pipeline security risks
- 8:28Implementing OIDC roles
- 9:17Configuring pipeline tokens
- 10:15OIDC claim analysis
- 11:30Principle of least privilege
- 12:43Policy matching techniques
- 13:34Granular resource access
- 14:46Demo resources
- 15:09Key takeaways
related talks
34mSecuring your CICD Pipeline
34mZero trust CI/CD pipeline
32mAre your CI/CD Pipelines Secure
20mSecuring OIDC Federation in CI/CD Workflows
28mMitigating OWASP Top 10 CI/CD with AWS
08mLightning Talk: Don't Wait, Secure your DevOps Processes Using Open Standar...
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
45mAttackers' Nightmare: An Infrastructure Without Secrets