I Can OIDC You Clearly Now: How We Made Static Credentials a...
summary
Grafana Labs replaces long‑lived static credentials with GitHub Actions OIDC to get short‑lived cloud tokens, using workload identity federation for GCP and an AWS Cognito/OIDC pattern; Terraform modules create one service account per repo and a public grafana-shared-workflows repo so CI can be secretless. A misconfiguration (forgot to validate repository/subject claims) let unrelated repos gain access; it is fixed with attribute conditions and strict subject checks. It works in practice but tokens remain sensitive, must not be logged, and some providers still require fallbacks to Vault for static creds.
AI-written summary · about
chapters (9)
- 0:00Introduction and context
- 0:57The problem with secrets
- 3:23Introduction to OIDC
- 7:45OIDC in Google Cloud
- 10:19Implementing secure CI
- 14:58Transparency and security
- 18:21Learning from mistakes
- 21:35Centralized control
- 24:12Conclusion and call to action
related talks
50mDestroying Long-Lived Cloud Credentials with Workload Identity Federation
20mSecuring OIDC Federation in CI/CD Workflows
17mOIDC and CICD: Why Your CI Pipeline Is Your Greatest Security Threat
38mUsing OIDC With HashiCorp Vault and GitHub Actions
45mAttackers' Nightmare: An Infrastructure Without Secrets
34mThrow Away Your Passwords: Trusting Workload Identity
21mAutomating Secure OIDC-Based Cross-Cloud Authentication
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls