RFC-WORKLOAD-IDENTITY-0001                                      Section 6
Category: Standards Track                                  CI/CD Identity

# Terraform: OIDC provider
resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
}
 
# Terraform: IAM role with OIDC trust
resource "aws_iam_role" "github_actions" {
  name = "github-actions-deploy"
 
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Federated = aws_iam_openid_connect_provider.github.arn
      }
      Action = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = {
          "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
        }
        StringLike = {
          "token.actions.githubusercontent.com:sub" = "repo:myorg/myrepo:*"
        }
      }
    }]
  })
}

name: Deploy
on:
  push:
    branches: [main]
 
permissions:
  id-token: write   # Required for OIDC
  contents: read
 
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
          aws-region: us-east-1
 
      - name: Deploy
        run: |
          aws s3 sync ./dist s3://my-bucket/

# Enable JWT auth
vault auth enable -path=github-actions jwt
 
# Configure OIDC provider
vault write auth/github-actions/config \
    oidc_discovery_url="https://token.actions.githubusercontent.com" \
    bound_issuer="https://token.actions.githubusercontent.com"
 
# Create role for specific repo
vault write auth/github-actions/role/deploy \
    role_type="jwt" \
    bound_audiences="https://github.com/myorg" \
    bound_claims_type="glob" \
    bound_claims='{
      "repository": "myorg/myrepo",
      "ref": "refs/heads/main"
    }' \
    user_claim="repository" \
    policies="deploy" \
    ttl="10m"

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Authenticate to Vault
        uses: hashicorp/vault-action@v2
        with:
          url: https://vault.example.com
          method: jwt
          path: github-actions
          role: deploy
          exportToken: true
 
      - name: Get secrets
        run: |
          vault kv get -field=api_key secret/deploy/api

# Enable JWT auth for GitLab
vault auth enable -path=gitlab jwt
 
# Configure OIDC provider
vault write auth/gitlab/config \
    oidc_discovery_url="https://gitlab.com" \
    bound_issuer="https://gitlab.com"
 
# Create role
vault write auth/gitlab/role/deploy \
    role_type="jwt" \
    bound_claims='{
      "project_path": "myorg/myrepo",
      "ref": "main"
    }' \
    user_claim="project_path" \
    policies="deploy" \
    ttl="10m"

deploy:
  stage: deploy
  image: hashicorp/vault:1.15
  id_tokens:
    VAULT_ID_TOKEN:
      aud: https://vault.example.com
  script:
    - export VAULT_ADDR=https://vault.example.com
    - vault write auth/gitlab/login role=deploy jwt=$VAULT_ID_TOKEN
    - vault kv get secret/deploy/config

apiVersion: v1
kind: ServiceAccount
metadata:
  name: build-pipeline
  namespace: tekton-pipelines
---
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: build
spec:
  tasks:
    - name: build
      taskRef:
        name: build-task
---
apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: build-run
spec:
  pipelineRef:
    name: build
  taskRunSpecs:
    - pipelineTaskName: build
      serviceAccountName: build-pipeline

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: deploy
spec:
  volumes:
    - name: vault-token
      projected:
        sources:
          - serviceAccountToken:
              path: token
              expirationSeconds: 600
              audience: vault
  steps:
    - name: get-secrets
      image: hashicorp/vault:1.15
      volumeMounts:
        - name: vault-token
          mountPath: /var/run/secrets/vault
      script: |
        export VAULT_ADDR=https://vault.vault.svc.cluster.local:8200
        vault write auth/kubernetes/login \
          role=tekton-deploy \
          jwt=$(cat /var/run/secrets/vault/token)
        vault kv get -field=password secret/deploy/db

# Enable AppRole
vault auth enable approle
 
# Create role
vault write auth/approle/role/legacy-ci \
    secret_id_ttl=1h \
    token_ttl=1h \
    token_max_ttl=4h \
    secret_id_num_uses=1 \
    policies="ci-secrets"
 
# Get Role ID (stored in CI config)
vault read auth/approle/role/legacy-ci/role-id
 
# Generate Secret ID (single-use, rotated)
vault write -f auth/approle/role/legacy-ci/secret-id

# GitHub Actions
jobs:
  deploy-prod:
    environment: production
    runs-on: ubuntu-latest
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/prod-deploy