OIDC authentication for CI/CD in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of OIDC in CI/CD pipelines?

OpenID Connect (OIDC) is often used in CI/CD pipelines. What is its main purpose?

A To securely authenticate pipeline jobs without storing long-lived credentials

B To encrypt all data transferred between pipeline stages

C To manage version control of pipeline scripts

D To monitor pipeline performance metrics in real-time

💡 Hint

Think about how pipelines avoid using static secrets.

OIDC allows CI/CD jobs to authenticate dynamically using short-lived tokens, avoiding the need to store static credentials.

💻 Command Output

intermediate

What is the output of this Terraform snippet configuring OIDC provider?

Given this Terraform code snippet, what will be the value of aws_iam_openid_connect_provider.example.url after apply?

Terraform

resource "aws_iam_openid_connect_provider" "example" {
  url = "https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E"
  client_id_list = ["sts.amazonaws.com"]
  thumbprint_list = ["9e99a48a9960b14926bb7f3b02e22da0afd6e1e4"]
}

A 9e99a48a9960b14926bb7f3b02e22da0afd6e1e4

B https://oidc.eks.us-west-2.amazonaws.com/id/INVALID

C https://sts.amazonaws.com

D https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E

💡 Hint

Look at the url attribute in the resource.

The url attribute is set explicitly to the OIDC provider URL string.

❓ Configuration

advanced

Which Terraform block correctly configures a trust relationship for OIDC in an IAM role?

Choose the Terraform assume_role_policy JSON that correctly allows OIDC authentication from a specific provider.

A

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Principal": {"AWS": "*"},
    "Action": "sts:AssumeRole"
  }]
}

B

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Federated": "arn:aws:iam::123456789012:oidc-provider/invalid-provider"},
    "Action": "sts:AssumeRoleWithWebIdentity"
  }]
}

C

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Federated": "arn:aws:iam::123456789012:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E"},
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
      "StringEquals": {
        "oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:sub": "system:serviceaccount:default:my-service-account"
      }
    }
  }]
}

D

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "ec2.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}

💡 Hint

Look for the correct Principal and Action for OIDC.

The trust policy must allow sts:AssumeRoleWithWebIdentity for the correct OIDC provider ARN and include conditions for the service account.

❓ Troubleshoot

advanced

Why does this GitHub Actions workflow fail to authenticate with AWS using OIDC?

Given this snippet from a GitHub Actions workflow, why does the AWS CLI command fail with 'AccessDenied'?

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubOIDCRole
          aws-region: us-west-2
      - name: Deploy
        run: aws s3 ls

A The workflow is missing the 'id-token: write' permission

B The IAM role's trust policy does not allow GitHub's OIDC provider

C The AWS region is incorrectly specified

D The AWS CLI command 'aws s3 ls' is invalid

💡 Hint

Check the IAM role trust policy for OIDC provider permissions.

If the IAM role's trust policy does not include GitHub's OIDC provider ARN, the role assumption will fail with AccessDenied.

🔀 Workflow

expert

Order the steps to enable OIDC authentication for a CI/CD pipeline deploying to AWS

Arrange these steps in the correct order to set up OIDC authentication for a CI/CD pipeline that deploys to AWS.

A 1,3,2,4

B 1,2,3,4

C 3,1,2,4

D 2,1,3,4

💡 Hint

Think about setting up AWS first, then configuring the pipeline to use it.

First, create the OIDC provider in AWS (1), then create the IAM role trusting that provider (3). Next, configure the pipeline to request tokens (2), and finally assume the role (4).