Codify Your JWT-OIDC Vault Auth Method with Terraform
summary
Shows how Terraform fully configures Vault JWT/OIDC auth for GitLab, Okta, and GitHub with working examples and a public repo, including the exact resources used for the mount and role, provider credentials, redirect URIs, claim mappings, and policies. Explains that the mount handles the OIDC discovery URL or JWK and connection creds while the roles define user claim, bound claims/audiences, and Vault policies. Demonstrates codified CI/CD setup so the config is reproducible and usable.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker background
- 1:50JWT-OIDC Vault Auth Method overview
- 4:45How Vault auth methods work
- 7:11Configuring the JWT mount in Vault
- 9:37Setting up roles and redirects
- 11:23Defining user claims and bound audiences
- 13:56Back policies and security best practices
- 14:59Terraform code walkthrough
- 16:46Automating with CI/CD pipelines
- 17:28Q&A and resources
related talks
46mVault configuration as code via HashiCorp Terraform - Stories from trenches
25mSecure Your Terraform Deploys in GitLab-CI with HashiCorp Vault
38mUsing OIDC With HashiCorp Vault and GitHub Actions
25mBetter Together: JWT and Vault in Modern Apps
31mHashiCorp Vault Configuration as Code via HashiCorp Terraform: Stories From the Trenches
23mManaging Vault with Terraform
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
28mSecure CI/CD Using JSON Web Token (JWT)