skills.rest
nicolasmosquerar
nicolasmosquerarCOMMUNITY
Explore all skills by this author →
GitHub

OIDC & IRSA Patterns

Configure AWS OIDC providers and IRSA for keyless CI/CD and EKS authentication.

1|Updated Jan 26, 2026
Search Tags:#aws#kubernetes#ci-cd#oidc#irsa#iam-roles-for-service-accounts
One-click install
npx skills add https://github.com/nicolasmosquerar/AI-skills-for-Iac --skill oidc-irsa-patterns
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: OIDC & IRSA Patterns
Source: https://github.com/nicolasmosquerar/AI-skills-for-Iac/tree/main/.agent/skills/oidc-irsa-patterns
Command: npx skills add https://github.com/nicolasmosquerar/AI-skills-for-Iac --skill oidc-irsa-patterns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

OIDC and IRSA patterns enable keyless authentication for CI/CD pipelines and Kubernetes workloads by replacing static credentials with short-lived tokens and scoped roles.

Core Features & Use Cases

  • OIDC-based authentication for CI/CD platforms (GitHub Actions, GitLab CI) to AWS without static credentials
  • IRSA support for Kubernetes pods on EKS, enabling per-service-account IAM roles
  • Fine-grained trust policies scoped to repositories/branches and to Kubernetes service accounts
  • Security best practices and reusable patterns for auditable access control

Quick Start

Configure an AWS OIDC provider for your CI/CD platform and enable IRSA on your EKS cluster to start using short-lived credentials.

Frequently Asked Questions about OIDC & IRSA Patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure keyless authentication for GitHub Actions to AWS?▼

Keyless authentication for GitHub Actions to AWS replaces static credentials with short-lived tokens by configuring an AWS OIDC provider and creating IAM roles with trust policies scoped to your repository branches.

What is IRSA and how does it secure Kubernetes pods on EKS?▼

IRSA is IAM Roles for Service Accounts, enabling Kubernetes pods on EKS to assume scoped AWS IAM roles per service account using short-lived tokens instead of static credentials.

Can I use OIDC with GitLab CI to access AWS resources without static credentials?▼

Yes, GitLab CI supports OIDC-based authentication to AWS without static credentials by configuring an AWS OIDC provider and aligning IAM trust policies with your GitLab repository references.

How do I scope IAM trust policies for Kubernetes service accounts on EKS?▼

You scope IAM trust policies for EKS Kubernetes service accounts by aligning the policy conditions with specific service account names and namespaces, ensuring fine-grained, auditable access control.

Do I need an existing EKS cluster to use IRSA for pod identity?▼

Yes, IRSA requires an existing EKS cluster with the feature enabled, alongside an AWS OIDC provider and configured IAM roles to grant Kubernetes workloads scoped cloud resource access.

Why replace long-lived credentials with short-lived tokens in CI/CD pipelines?▼

Replacing long-lived credentials with short-lived OIDC tokens in CI/CD pipelines reduces security risks by ensuring auditable, fine-grained access control without storing static secrets in GitHub Actions or GitLab CI.

Related Skills

Explore More Software Engineering Skills→
aurainfosecaurainfosec

eks

Validate AWS EKS cluster security posture and public endpoint accessibility.

Official
Intermediate
kubonykubony
10

gcp-iam

Manage GCP IAM service accounts, roles, keys, and policies via gcloud.

Community
Intermediate
nicolasmosquerarnicolasmosquerar
1

IAM Least Privilege Patterns

Enforce least-privilege IAM policies with scoped permissions and IRSA for Kubernetes.

Community
Intermediate
heaptracetechnologyheaptracetechnology
13

credential-lifecycle

Automate credential lifecycle management across AWS, Azure, and GCP.

Community
Advanced