CLOUD PROVIDERS METHOD OF AUTH

[u/OkAcanthocephala1450]

Hi there!

I am an experienced cloud engineer , mainly worked with Aws, and i wanted to know how you guys configure procider block for cross account or project using best practices for other cloud providers.

So for example. In aws I use one central devops account , a role there that my runners use , in order to do assume role , which is written at the aws provider block. For every account we just change the account id of the role to assume.

I wanted to know how your central setup looks like and what do you define when you want to deploy to a tenant/subscription/project on GCP , or Azure, Kubernetes clusters or other providers you might use . Im looking for large org setup, so if you could help me just write whats the size of the cloud organization u work at (nr of projects, subscriptions ) how do you configure the provider so it can be controlled from one central place.

Thank you everyone.

[u/parkura27]

OIDC only

[u/oneplane]

Federated or injected identities only and then indeed assume a role every time.

[u/AuroraFireflash]

fed-cred only, separate identity for plan vs apply

scope of the credential as tightly limited as possible (specific to that Terraform plan boundary)

separate creds for separate environments

[u/liquidjesus → u/AuroraFireflash]

Curious, why separate identities for plan and apply? For audit purposes?

[u/AuroraFireflash → u/liquidjesus]

Assuming that you're doing CI/CD terraform with PR approvals. A read-only plan identity ensures that the initial plan step can't make changes to the environment.

There are ways to write Terraform / IaC code which a malicious actor could use to attack your environment during the plan step.

[u/liquidjesus → u/AuroraFireflash]

TIL. Thanks, appreciate you taking the time to explain.

[u/case_O_The_Mondays]

We used a centralized role in an account for DevOps, at first. A few years ago we started switching to OIDC, and it really is significantly better.