World map

 

BM

World T4: Modules & Pipelines

Secrets and OIDC

You will learn: how a pipeline gets cloud access and passwords without storing keys in files.

Checked with OpenTofu 1.13 on 1 Nov 2026

The problem

Ben copied this plan workflow from a blog. Find the three holes.

Tap every risky line. Each one shows the attack and the fix.

Workflow file .github/workflows/plan.yml

Watch

OIDC (OpenID Connect): The runner shows a visitor badge for one job. The cloud checks it and lends a key that expires when the job ends. works like a visitor badge. The job proves who it is. The cloud lends it a key that expires soon. Put the steps in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • It shows the token to the cloud
  • tofu plan runs with those keys
  • The cloud lends keys that expire soon
  • The job asks GitHub for a short-lived ID token
  • The cloud checks: the right repo and branch?

Predict

Which permission lets the job ask GitHub for that ID token?

permissions:
  id-token: write
  contents: read

Try it

The database password must never sit in a file. Pass it in an environment variable: export TF_VAR_db_password=teh-tarik-42. Then tofu apply.

Blueprint (your .tf files)init done

  • local_sensitive_file.db_confnot built yet

Built (the state file)

Nothing built yet.

Blueprint: 1 resources. Built: 0.

Change a file, then run tofu plan to see what it means.

Check

Sort each way of getting secrets into a pipeline.

Drag a card into a box. Or tap the card, then tap the box.

      Check

      The team switched to OIDC. What does the repo store for the cloud now?

      You did it!

      You can now give a pipeline cloud access and secrets without storing keys.

      Go deeper (optional)

      The cloud’s trust rule should name your repo and branch. Then other repos can’t borrow the badge. Put the apply job in a GitHub environment with required reviewers. The CI/CD course goes deeper: World C3: OIDC. Remember: the register can still hold secrets (T3·7).