OIDC authentication for CI/CD in Terraform - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does OIDC stand for and why is it used in CI/CD pipelines?

OIDC stands for OpenID Connect. It is used in CI/CD pipelines to securely authenticate and authorize workflows without storing long-lived credentials, improving security by using short-lived tokens.

intermediate

How does OIDC improve security in Terraform workflows?

OIDC allows Terraform workflows to request temporary tokens from an identity provider, avoiding hardcoded secrets. This reduces risk of credential leaks and simplifies access management.

intermediate

In Terraform, which resource or provider is commonly configured to use OIDC for authentication?

Terraform often uses the 'aws' provider configured with an OIDC role assumption or the 'google' provider with workload identity federation to authenticate using OIDC tokens.

beginner

What is the role of the identity provider (IdP) in OIDC authentication for CI/CD?

The identity provider issues ID tokens after verifying the workflow's identity. These tokens prove the workflow's identity to cloud providers, enabling secure access without static credentials.

advanced

Explain the concept of 'workload identity federation' in the context of OIDC and Terraform.

Workload identity federation lets Terraform workflows authenticate to cloud providers by exchanging OIDC tokens from the CI/CD system, avoiding the need for service account keys or secrets.

What is the main benefit of using OIDC authentication in CI/CD pipelines?

A Enable manual approvals

B Increase build speed

C Avoid storing long-lived credentials

D Reduce code size

OIDC allows workflows to authenticate using short-lived tokens, avoiding the need to store long-lived credentials.

Which Terraform provider commonly supports OIDC authentication for AWS?

A aws

B random

C azure

D google

The 'aws' provider supports OIDC role assumption for authentication.

In OIDC, what does the identity provider (IdP) issue to prove identity?

A ID token

B Access key

C Password

D SSH key

The IdP issues an ID token that proves the identity of the requester.

What is workload identity federation used for in Terraform CI/CD workflows?

A To store secrets securely

B To authenticate using OIDC tokens without service account keys

C To speed up deployments

D To encrypt Terraform state files

Workload identity federation allows authentication using OIDC tokens, avoiding the need for static service account keys.

Which of the following is NOT a benefit of OIDC in CI/CD?

A Improved security

B Simplifies access management

C Eliminates need for manual credential rotation

D Requires storing static passwords

OIDC reduces or eliminates the need to store static passwords, so option B is NOT a benefit.

Describe how OIDC authentication works in a CI/CD pipeline using Terraform.

Think about the token flow and how Terraform gains access securely.

Explain the advantages of using workload identity federation with OIDC in Terraform CI/CD workflows.

Focus on security and credential handling improvements.