OIDC authentication for CI/CD in Terraform - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define an OIDC provider in Terraform.

Terraform

resource "aws_iam_openid_connect_provider" "example" {
  url = "[1]"
  client_id_list = ["sts.amazonaws.com"]
  thumbprint_list = ["9e99a48a9960b14926bb7f3b02e22da0afd6e4a9"]
}

Drag options to blanks, or click blank then click option'

Ahttps://sts.amazonaws.com

Bhttps://example.com/oidc

Chttps://oidc.provider.com/token

Dhttps://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E

Attempts:

3 left

💡 Hint

Common Mistakes

Using the token endpoint URL instead of the provider URL.

Using a generic URL not related to your OIDC provider.

The url must be the OIDC provider URL for your cluster or CI/CD system. This example uses an EKS OIDC URL.

2fill in blank

medium

Complete the code to attach a trust policy for OIDC to an IAM role.

Terraform

resource "aws_iam_role" "ci_cd_role" {
  name = "ci-cd-role"
  assume_role_policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {
        "Federated": "[1]"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:sub": "system:serviceaccount:default:ci-cd-sa"
        }
      }
    }]
  })
}

Drag options to blanks, or click blank then click option'

Aarn:aws:iam::123456789012:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E

Barn:aws:iam::123456789012:user/ci-cd-user

Carn:aws:iam::123456789012:role/ci-cd-role

Darn:aws:iam::123456789012:saml-provider/ci-cd-saml

Attempts:

3 left

💡 Hint

Common Mistakes

Using the role ARN instead of the OIDC provider ARN.

Using a user or SAML provider ARN by mistake.

The Federated principal must be the ARN of the OIDC provider created earlier.

3fill in blank

hard

Fix the error in the trust policy condition key for the OIDC role.

Terraform

  "Condition": {
    "StringEquals": {
      "[1]": "system:serviceaccount:default:ci-cd-sa"
    }
  }

Drag options to blanks, or click blank then click option'

Aoidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:exp

Boidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:sub

Coidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:iss

Doidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:aud

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'aud' or 'iss' instead of 'sub' in the condition key.

Leaving the key incomplete or misspelled.

The sub claim is used to match the Kubernetes service account in the condition.

4fill in blank

hard

Fill both blanks to create a policy document that allows assuming the role only for a specific service account.

Terraform

  "Condition": {
    "StringEquals": {
      "[1]": "[2]"
    }
  }

Drag options to blanks, or click blank then click option'

Aoidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:sub

Bsystem:serviceaccount:default:ci-cd-sa

Csystem:serviceaccount:prod:deploy-sa

Doidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:aud

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up the audience claim with the subject claim.

Using a service account from a different namespace.

The condition key must be the OIDC provider's subject claim, and the value must be the exact Kubernetes service account allowed.

5fill in blank

hard

Fill all three blanks to define an IAM role with OIDC trust and attach a policy allowing S3 access.

Terraform

resource "aws_iam_role" "ci_cd_role" {
  name = "ci-cd-role"
  assume_role_policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {
        "Federated": "[1]"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "[2]": "[3]"
        }
      }
    }]
  })
}

resource "aws_iam_policy_attachment" "ci_cd_attach" {
  name       = "ci-cd-s3-access"
  roles      = [aws_iam_role.ci_cd_role.name]
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
}

Drag options to blanks, or click blank then click option'

Aarn:aws:iam::123456789012:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E

Boidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:sub

Csystem:serviceaccount:default:ci-cd-sa

Darn:aws:iam::123456789012:role/ci-cd-role

Attempts:

3 left

💡 Hint

Common Mistakes

Using the role ARN instead of the OIDC provider ARN in the federated principal.

Mixing up the condition key with audience or issuer claims.

Using a wrong service account name or namespace.

The Federated principal is the OIDC provider ARN, the condition key is the subject claim, and the value is the Kubernetes service account allowed to assume the role. The attached policy grants read-only S3 access.