Identity Lab
Members

Protocol practice· Cloud & Workload Identity Members

Workload identity federation: a pipeline gets cloud access with no stored keys

Objective: Lumen Notes deploys from GitHub Actions to AWS with an access key pasted into the repository’s secrets two years ago. Replace it: let AWS trust GitHub’s own tokens, let only the production deploy job in, and make sure a pull request can’t deploy.

5 steps11 concepts 12 min
Where workload federation fits

What may this app do? · 6 labs

Not sure? Which protocol?

What you’ll do

  1. 1Tell AWS to trust GitHub’s tokens. Every GitHub Actions job can ask GitHub for a short-lived OpenID Connect token that says which repository, branch and environment it’s running for.
  2. 2Decide which jobs may become the deploy role. The role notes-deploy can update the production service.
  3. 3Let the deploy job ask for its token. A job only gets a token if the workflow allows it.
  4. 4AWS checks the token and hands out credentials. The action sends GitHub’s token to AWS STS with AssumeRoleWithWebIdentity.
  5. 5A pull request tries to deploy. A contributor opens a pull request that changes the deploy workflow so it runs on pull requests too.
Members onlyFree to join.Members get this lab, a practice record of every lab they finish, and tabletop scenarios to run with their team.
Join free Sign in