Hacker News Reader

Comment by simonw | Hacker News Reader

This is a really useful guide, but it's still not enough... every time I read something like this I get to a bit like this:

"Create a role on AWS, add trust policy specifying which github org+repo are allowed to access this AWS role. Create an identity provider for github actions."

I think need a full video of clicking around in the AWS console here, because the idea of having to figure out how to do that myself is horrifying to me.

View on HN

I've seen the same issue with instructions for how to configure Keycloak as an OIDC provider - given Keycloak has so many options (some of which might well be security significant), you'd almost want a step by step explicit statement of what every setting should be, to get to a tested, validated and secure configuration.

Which flow and service/grant etc seems to matter a lot, and be a good example where you'd want a very clear playbook of step by step instructions that you can hand off to someone else to unambiguously follow.

I've been wanting to setup GitHub Actions to use OIDC with Google Cloud (for deploying to Cloud Run) for a couple of years now, but I find the documentation completely inscrutable: https://docs.github.com/en/actions/deployment/security-harde...

The gist of it (pun intended) is that GitHub issues GitHub-issued (not issued by your cloud provider!) OIDC tokens to your job runs, and then your job exchanges those tokens for permissions with your cloud provider, which you have configured to trust tokens from GitHub.

From experience, OIDC authentication to cloud providers from GitHub actions boils down to:

1. Get your GitHub actions workflow to be able to work with its own (GitHub) tokens by configuring workflow permissions.

2. Configure your cloud provider to verify tokens issued by GitHub actions OIDC server thingymabob (technical term).

3. Configure your cloud provider to grant permissions in that cloud provider (or issue its own tokens with those permissions) based on certain values in the verified GitHub tokens that is presented with. If your cloud provider trusts GitHub, then it can treat the values in the token (workflow name, branch run from, owner and name of GitHub repo) as trusted.

4. Use a GitHub action from your cloud provider to do the negotiation with your cloud provider when your job runs, performing the exchange configured in (3).

For me to follow that procedure I really do need meticulous step-by-step instructions, with a full set of screenshots for every interaction I need to have with any of the web consoles involved.

If I ever get up enough courage to do this myself I'll take and publish those screenshots, but I'll probably continue to drag my heels for a few more years.

Jesus. We fucked with keycloak for like a minute at one of my past jobs where we used FreeIPA. Gave up, and just didn’t use that functionality beyond whatever default stuff it m if it do. IAM is hard. I kind of enjoy it, but there’s always a hundred other things I’m accountable for managing.

What you're supposed to do is have an alcohol-fueled all-night session of modifying values in your Keycloak realm settings one at a time until it works. Then, you export the realm file and tell everyone not to mess with it.

Enabling devs to do development work on their local machines with Keycloak in the stack is... fun /s.

It's not terribly difficult. I just threw a quick gist to help with this OIDC for Github in AWS - https://gist.github.com/sakopov/a66ef55f9713649e7d7b9b4a91d6...

Thanks for that, that's actually really useful - though I don't use cloudformation yet so I'd have to learn enough of that to put this into action.

Love that you have to just happen to know about "1b511abead59c6ce207077c0bf0e0043b1382612" as the magical "known thumbprint" for GitHub!

No worries, glad it's helping. AWS Console will automatically discover the thumbprint when adding a new provider, so I just grabbed it from there.

>I think need a full video of clicking around in the AWS console here, because the idea of having to figure out how to do that myself is horrifying to me.

Or even better, was CLI commands or terraform.

CLI commands would be OK. Terraform wouldn't, because then I'll have to learn enough Terraform to run it - I'd rather minimize the number of extra tools I have to figure out here.

True. Will try to add a loom video to this article

Reply on news.ycombinator.com