Q37: Building Secure CI/CD Pipelines: GitHub Actions layer caching, ephemeral runners, and OIDC keyless authentication. - DevOps & Kubernetes (50 Qs)

Cloud Authentication Without Static Secrets

Traditional CI/CD pipelines stored static, long-lived AWS Access Keys (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) as repository secrets. If compromised, attackers obtain permanent access to cloud infrastructure. Modern pipelines use OpenID Connect (OIDC) for temporary, keyless authentication.

ini

[ GitHub Actions Workflow ]
            | 1. Requests OIDC JWT token
            v
[ GitHub OIDC Identity Provider ]
            | 2. Returns short-lived cryptographically signed JWT
            v
[ GitHub Runner ] === 3. Presents JWT via AssumeRoleWithWebIdentity ===> [ AWS STS ]
                                                                             |
[ GitHub Runner ] <=== 4. Returns temporary 1-hour IAM credentials <=========+

Production GitHub Actions Workflow Blueprint

yaml

name: Production Build & Deploy
on:
  push:
    branches: [main]

permissions:
  id-token: write # Required for requesting the OIDC JWT token
  contents: read

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Authenticate to AWS via OIDC (No Static Keys!)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-production-deployer
          aws-region: us-east-1

      - name: Set up Docker Buildx & Cache
        uses: docker/setup-buildx-action@v3

      - name: Build & Push Container Image with GitHub Cache
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: 123456789012.dkr.ecr.us-east-1.amazonaws.com/api:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max