Skip to content

README.md

Latest commit

 

History

History
71 lines (53 loc) · 2.33 KB

README.md

File metadata and controls

71 lines (53 loc) · 2.33 KB
Raw

Replit Dev Modules

A collection of prebuilt modules for developing software with Replit.

Modules

Module What it does
aws-oidc Sets up the AWS CLI and SDKs with short-lived AWS credentials
gcp-oidc Sets up gcloud and the Google Cloud SDKs with short-lived Google Cloud credentials
azure-oidc Sets up the Azure CLI and SDKs with short-lived Microsoft Entra credentials
vault-oidc Sets up the HashiCorp Vault CLI with short-lived Vault tokens
infisical-oidc Sets up the Infisical CLI with short-lived Infisical access tokens

Each module's README covers its usage and options.

How OIDC works

Replit fully supports workload identity federation. Replit is an OpenID Connect (OIDC) identity provider, so any service that accepts external OIDC tokens can trust Replit workloads directly, with no long-lived credentials to store or rotate.

Mint a short-lived token for an audience:

replit identityv2 create --audience <audience>

Tokens are issued by https://sts.replit.com. Services discover it at https://sts.replit.com/.well-known/openid-configuration and verify signatures against https://sts.replit.com/.well-known/jwks.json.

Every token carries at least these claims:

{
  "iss": "https://sts.replit.com",
  "sub": "//replit.com/customer/<customer-id>/org/<org-id>/<kind>/<sandbox-id>",
  "aud": "<audience>",
  "exp": 1767225900,
  "jti": "00000000-0000-0000-0000-000000000000",
  "kind": "<kind>",
  "customer_id": "<customer-id>",
  "org_id": "<org-id>",
  "sandbox_id": "<sandbox-id>",
  "resource_group_id": "<resource-group-id>",
  ...
}

The sub prefix //replit.com/customer/<customer-id>/org/<org-id>/ is the same for every token in an organization; the rest identifies the workload that minted it, and varies by kind. Additional claims depend on the kind of workload. Bind trust to org_id (or the sub prefix), not to the full subject.

To see your own values, decode a token's body:

replit identityv2 create --audience TEST \
  | cut -d. -f2 | tr '_-' '/+' | base64 -d 2>/dev/null | python3 -m json.tool

Security

Report vulnerabilities as described in SECURITY.md.

License

MIT. See LICENSE.