---
title: "How to Create a Secure CI/CD Pipeline Using Okta Terraform"
description: "The guide presents a secure CI/CD pipeline for managing Okta resources with Terraform, AWS, and GitHub Actions, addressing local setup, collaboration, state storage, secrets, and deployment automation. Its architecture uses GitHub as source control and workflow trigger, GitHub OIDC to authenticate to AWS IAM STS and assume roles, S3 for Terraform state, DynamoDB for state locking, and AWS Secrets Manager for Okta OAuth 2.0 client credentials private keys. Developers push changes to develop for an automatic development build, open a pull request to main for a production plan, and merge approved changes to trigger the production build. The workflows run Terraform init, plan, and apply as appropriate, while the guide also covers repository setup, branch organization, and troubleshooting for missed configuration in GitHub, Okta, or AWS."
---

# How to Create a Secure CI/CD Pipeline Using Okta Terraform

[Okta](https://yomu.fyi/company/okta) · Nick Connelly · Oct 11, 2024

**Type:** Tutorial

## Summary

The guide presents a secure CI/CD pipeline for managing Okta resources with Terraform, AWS, and GitHub Actions, addressing local setup, collaboration, state storage, secrets, and deployment automation. Its architecture uses GitHub as source control and workflow trigger, GitHub OIDC to authenticate to AWS IAM STS and assume roles, S3 for Terraform state, DynamoDB for state locking, and AWS Secrets Manager for Okta OAuth 2.0 client credentials private keys. Developers push changes to develop for an automatic development build, open a pull request to main for a production plan, and merge approved changes to trigger the production build. The workflows run Terraform init, plan, and apply as appropriate, while the guide also covers repository setup, branch organization, and troubleshooting for missed configuration in GitHub, Okta, or AWS.

## Context

The pipeline connects GitHub, GitHub Actions, Terraform, AWS, and Okta. GitHub stores Terraform code and triggers workflows; AWS provides IAM authentication, temporary credentials, Terraform state storage, state locking, and secrets management; Terraform uses the Okta provider to manage Okta resources.

## Approach / What changed

The guide uses a private GitHub repository with develop and main branches. GitHub Actions authenticates to AWS through GitHub OIDC, retrieves Okta OAuth 2.0 client credentials from AWS Secrets Manager, stores Terraform state in S3 with DynamoDB locking, and runs development builds, production plans, or production builds based on branch and pull request events.

## Takeaways

- GitHub OIDC lets GitHub Actions authenticate with AWS IAM STS, assume roles with web identity, and use temporary credentials for Terraform backend operations.
- The workflow stores Terraform state in S3, uses DynamoDB for state locking, and retrieves Okta OAuth 2.0 client credentials private keys from AWS Secrets Manager.
- Changes pushed to develop trigger a development build; pull requests to main trigger a production plan, while merges to main trigger the production build.

## FAQ

### How does GitHub Actions authenticate to AWS without a stored AWS credential?

GitHub Actions uses GitHub OIDC to assume an AWS IAM role through AWS IAM STS. AWS returns temporary credentials for Terraform backend operations.

### What happens before changes reach the production environment?

A pull request from develop to main triggers Terraform init and plan for production without applying changes. Reviewers can inspect the planned output before approving and merging the pull request.

### Where are Terraform state and Okta credentials stored?

Terraform state files are stored in Amazon S3, with DynamoDB providing state locking to prevent concurrent operations. Okta OAuth 2.0 client credentials private keys are retrieved from AWS Secrets Manager.

**Tags:** [AWS](https://yomu.fyi/topic/aws), [CI/CD](https://yomu.fyi/topic/ci-cd), [GitHub Actions](https://yomu.fyi/topic/github-actions), [OAuth 2.0](https://yomu.fyi/topic/oauth-2-0), [Terraform](https://yomu.fyi/topic/terraform)

- Source: [Okta](https://developer.okta.com/blog/2024/10/11/terraform-ci-cd)
- Source URL: https://developer.okta.com/blog/2024/10/11/terraform-ci-cd
- Ingested by Yomu: 2026-09-17T14:06:23.103Z

[Read original post](https://developer.okta.com/blog/2024/10/11/terraform-ci-cd)