OIDC authentication for CI/CD in Terraform - Step-by-Step Execution

Process Flow - OIDC authentication for CI/CD

CI/CD Pipeline starts

↓

Request OIDC Token

↓

OIDC Provider validates request

↓

Token issued with claims

↓

Terraform uses token to authenticate

↓

Access cloud resources securely

↓

Pipeline continues with permissions

The CI/CD pipeline requests an OIDC token, which the provider validates and issues. Terraform uses this token to authenticate securely to cloud resources during the pipeline.

Execution Sample

Terraform

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "ci_role" {
  assume_role_policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Federated": "arn:aws:iam::123456789012:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E"},
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:sub": "system:serviceaccount:ci-cd:terraform"
        }
      }
    }]
  })
}

Terraform config defines an AWS provider with OIDC and an IAM role that trusts the OIDC provider for CI/CD authentication.

Process Table

Step	Action	Input/Condition	Result	Notes
1	CI/CD pipeline starts	Trigger pipeline	Pipeline begins execution	Pipeline triggered by code push
2	Request OIDC token	Pipeline requests token	OIDC provider receives request	Token request includes service account info
3	Validate token request	Check service account and conditions	Token issued with claims	Claims include subject and audience
4	Terraform uses token	Token passed to AWS provider	Authentication succeeds	Terraform can assume IAM role
5	Access AWS resources	Use assumed role permissions	Resources created/modified	Terraform applies infrastructure changes
6	Pipeline completes	All steps successful	Pipeline ends successfully	Infrastructure deployed securely

💡 Pipeline ends after successful authentication and resource deployment

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
OIDC Token	None	Requested	Issued with claims	Used by Terraform	Expired after pipeline
IAM Role	Defined in Terraform	No change	No change	Assumed by Terraform	In use during pipeline
Pipeline State	Idle	Running	Running	Running	Completed

Key Moments - 3 Insights

Why does Terraform need the OIDC token during the pipeline?

Terraform uses the OIDC token to prove its identity to AWS and assume the IAM role securely, as shown in execution_table step 4.

What ensures that only the CI/CD pipeline can assume the IAM role?

The IAM role's trust policy restricts assume role action to tokens with specific claims matching the CI/CD service account, as seen in the terraform code and execution_table step 3.

What happens if the OIDC token is invalid or missing?

Terraform authentication fails, and the pipeline cannot access AWS resources, stopping deployment before step 5.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the OIDC token issued?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Check the 'Result' column for token issuance in execution_table row with Step 3.

According to variable_tracker, what is the state of the IAM Role after Step 4?

A Assumed by Terraform

B Defined in Terraform

C Expired

D Deleted

💡 Hint

Look at the 'IAM Role' row under 'After Step 4' in variable_tracker.

If the pipeline state was 'Idle' at start, when does it become 'Completed'?

A After Step 2

B After Step 4

C After Step 6

D Never

💡 Hint

Check the 'Pipeline State' row in variable_tracker for the 'Final' column.

Concept Snapshot

OIDC authentication for CI/CD:
- CI/CD pipeline requests OIDC token from provider
- Provider validates and issues token with claims
- Terraform uses token to assume IAM role securely
- IAM role trust policy restricts access to specific service accounts
- Enables secure, short-lived credentials for cloud access
- Avoids storing long-term secrets in pipelines

Full Transcript

This visual execution shows how OIDC authentication works in a CI/CD pipeline using Terraform. The pipeline starts and requests an OIDC token from the provider. The provider validates the request and issues a token with claims identifying the pipeline's service account. Terraform uses this token to authenticate to AWS by assuming an IAM role with a trust policy that allows only this token. This process enables secure access to cloud resources without long-term secrets. The pipeline completes after Terraform applies infrastructure changes using the assumed role.