Destroying Long-Lived Cloud Credentials with Workload Identity Federation
summary
Demonstrates a working cross-cloud demo: a GitHub Actions workflow runs Terraform to deploy an Azure VM that calls AWS S3 and Google GCS, first using long‑lived secrets then switching to GitHub Actions OIDC and Azure managed identity to exchange JWTs for credentials. Shows exact API calls (AZ login --federated-token, AWS STS assume-role-with-web-identity, gcloud with client config), provides an open source repo, and uses Terraform bootstraps across Azure AWS GCP producing 60-minute short-lived tokens that successfully replace persistent keys.
AI-written summary · about
chapters (7)
- 0:00Introduction and setup
- 2:10Problem statement and risks
- 19:14Workload Identity Federation overview
- 27:57GitHub to Azure authentication
- 33:24Azure VM to AWS access
- 42:07Azure VM to Google Cloud access
- 49:10Next steps and conclusion
related talks
21mAutomating Secure OIDC-Based Cross-Cloud Authentication
29mI Can OIDC You Clearly Now: How We Made Static Credentials a...
26mAzure Managed Identities: Why are you still using anything else?!?
34mZero trust CI/CD pipeline
34mThrow Away Your Passwords: Trusting Workload Identity
22mHow to Secure Cloud Machine Identities
20mSecuring OIDC Federation in CI/CD Workflows
57mGitHub Actions: A Cloudy Day for Security