Automating Secure OIDC-Based Cross-Cloud Authentication
summary
Claims a firm rule: stop using long‑lived AWS access keys and instead mint short‑lived credentials via OIDC. Demonstrates an automation factory that listens to CloudTrail events, uses EventBridge to trigger Step Functions + Lambda workflows that call the Microsoft Entra ID API to create app registrations, exchanges tokens for AWS STS temporary tokens, updates the IM OIDC provider audience and the role trust policy, and tears down on deletion. Provides Terraform and GitHub code and a working demo.
AI-written summary · about
chapters (8)
- 0:00Secure OIDC cross-cloud auth
- 1:07Access keys insecure for production
- 5:29OIDC tokens for secure auth
- 7:09AWS IM OIDC provider
- 11:23Manual OIDC config challenges
- 13:29Automating OIDC setup at scale
- 17:03Key takeaways and demo
- 17:31Live OIDC workflow demo
related talks
50mDestroying Long-Lived Cloud Credentials with Workload Identity Federation
25mHow to Kill an AWS Access Key
20mSecuring OIDC Federation in CI/CD Workflows
34mZero trust CI/CD pipeline
17mOIDC and CICD: Why Your CI Pipeline Is Your Greatest Security Threat
28mYour journey to temporary credentials in the cloud
01h 00mAWS Identity Workshop
34mThrow Away Your Passwords: Trusting Workload Identity