How I Eliminated Access Keys from My Deployment Pipeline with OIDC, Terraform, and GitHub Actions

The Problem with Traditional CI/CD

Most tutorials for deploying static sites to AWS recommend storing AWS access keys as GitHub secrets, creating a significant security vulnerability. If a repository is compromised or secrets are accidentally exposed, attackers gain full AWS access. OpenID Connect (OIDC) federation offers a more secure alternative by utilizing temporary credentials.

This author built a fully automated static website deployment pipeline that eliminates access keys entirely by using temporary credentials exchanged through OIDC, resulting in a live demo available at https://d2jgqhup9totr6.cloudfront.net and source code on GitHub.

Why This Matters

Traditional CI/CD pipelines relying on long-lived access keys represent a substantial security risk, with potential costs reaching into the millions due to data breaches or service disruption. OIDC addresses this by providing temporary, scoped credentials, reducing the attack surface and simplifying credential management. The scale of potential damage from compromised keys necessitates a shift towards more secure authentication methods.

Key Insights

• S3 Website Endpoint Configuration: Standard S3 origins don’t support features like redirects and error documents, requiring custom origin configuration in CloudFront.
• Least Privilege Principle: IAM roles should only be granted the minimum necessary permissions to perform their tasks, limiting the potential blast radius of a compromise.
• Terraform Remote State: Using remote state with locking (e.g., S3 backend with DynamoDB locking) is crucial for team collaboration and preventing state corruption in production environments.

Working Example

resource "aws_iam_openid_connect_provider" "github" {
url = "https://token.actions.githubusercontent.com"
client_id_list = ["sts.amazonaws.com"]
thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
}

resource "aws_iam_role" "github_actions" {
name = "github-actions-s3-deployment"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Principal = {
Federated = aws_iam_openid_connect_provider.github.arn
}
Action = "sts:AssumeRoleWithWebIdentity"
Condition = {
StringEquals = {
"token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
}
StringLike = {
"token.actions.githubusercontent.com:sub" = "repo:${var.github_username}/${var.repo_name}:ref:refs/heads/main"
}
}
}]
})
}

Practical Applications

• Static Website Hosting: Companies like Netlify or Vercel can leverage OIDC for secure deployments of static websites to AWS S3 and CloudFront.
• Pitfall: Failing to properly configure the StringLike condition in the IAM role trust policy can inadvertently grant broader access than intended, defeating the purpose of OIDC.

References:

• https://dev.to/escanut/how-i-eliminated-access-keys-from-my-deployment-pipeline-with-oidc-terraform-and-github-actions-jek