Getting the Lockbox secret value on the GitHub side

Workload Identity Federations allow you to configure a link between external systems and Yandex Cloud via the OpenID Connect (OIDC) protocol. This allows external systems to perform actions on Yandex Cloud resources on behalf of service accounts without generating static credentials, such as authorized keys or IAM tokens. This is a more secure method that minimizes the risk of credential leakage and the possibility of unauthorized access.

This tutorial shows you as an example how to get the Yandex Lockbox secret value from the GitHub side under a Yandex Cloud service account. Similarly, you can perform any action via the Yandex Cloud CLI, API, or Terraform.

To get the Yandex Lockbox secret value under a GitHub account:

1. Create a repository in GitHub.
2. Prepare your cloud.
3. Configure a GitHub Actions script.

If you no longer need the resources you created, delete them.

Create a repository in GitHubCreate a repository in GitHub

Create a new GitHub repository or use an existing one where you have permissions to view and run GitHub Actions.

Prepare your cloudPrepare your cloud

Sign up for Yandex Cloud and create a billing account:

1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

The infrastructure support cost includes a fee for storing a secret and requests to it (see Yandex Lockbox pricing).

Create a workload identity federationCreate a workload identity federation

Create a custom secretCreate a custom secret

Create a service account.Create a service account.

1. Create a service account:

   Management console

   1. In the management console, select the folder where you want to create a service account.
   2. In the list of services, select Identity and Access Management.
   3. Click Create service account.
   4. Enter a name for the service account, e.g., sa-lockbox.
   5. Click Create.

2. Assign the lockbox.payloadViewer role for the folder to the service account:

   Management console

   1. On the management console home page, select a folder.
   2. Go to the Access bindings tab.
   3. Find the sa-lockbox account in the list and click .
   4. Click Edit roles.
   5. Click Add role in the dialog that opens and select the lockbox.payloadViewer role.

Link the service account to the FederationLink the service account to the Federation

Configure a GitHub Actions scriptConfigure a GitHub Actions script

1. Clone your repository if you have not done so already:

   git clone <repository_URL>
   

2. In a local copy of your repository, create a file named blank.yml in the .github/workflows directory.

3. Insert the following code into the blank.yml file that will get the value of the Yandex Lockbox secret:

   name: CI
   
   permissions:
     id-token: write # Required to request a JWT token
   
   # Controls when the workflow will run
   on:
     # Runs a script on push or pull request in the _main_ branch
     push:
       branches: [ "main" ]
     pull_request:
       branches: [ "main" ]
   
     # Allows running a script manually in the Actions tab
     workflow_dispatch:
   
   jobs:
     job:
       runs-on: ubuntu-latest
       steps:
       - name: Install OIDC Client from Core Package
         run: npm install @actions/core @actions/http-client
       # Getting the workflow task token
       - name: Get Id Token
         uses: actions/github-script@v7
         id: tokenid
         with:
           script: |
             const coredemo = require('@actions/core')
             let id_token = await coredemo.getIDToken()
             coredemo.setOutput('id_token', id_token)
       # Exchanging the workflow task token for an IAM token of a service account in Yandex Cloud
       - name: GetIAMToken
         run: |
           SA_ID="<service_account_ID>"
           IAMTOKEN=$(curl -sH "Content-Type: application/x-www-form-urlencoded" -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&requested_token_type=urn:ietf:params:oauth:token-type:access_token&audience=$SA_ID&subject_token=${{steps.tokenid.outputs.id_token}}&subject_token_type=urn:ietf:params:oauth:token-type:id_token" -X POST https://auth.yandex.cloud/oauth/token | jq -r '.access_token')
           echo "IAMToken=${IAMTOKEN}" >> $GITHUB_OUTPUT
         id: IAMtoken
       # Requesting secret value via the API using an IAM token in Yandex Cloud
       - name: GetLockboxPayload
         run: |
           SECRET_ID="<secret_ID>"
           SECRET_DATA=$(curl -sH "Authorization: Bearer ${{steps.IAMtoken.outputs.IAMTOKEN}}" https://payload.lockbox.api.cloud.yandex.net/lockbox/v1/secrets/$SECRET_ID/payload)
           echo "SECRET_DATA=${SECRET_DATA}" >> $GITHUB_OUTPUT
         id: getlockboxpayload
   

   Where:

   • SA_ID: Service account ID.
   • SECRET_ID: Custom secret ID.

4. Save the file and submit the changes to the remote repository:

   git add . && git commit -m "Added blank.yml" && git push
   

   Once you submit the code to the repository, the workflow will begin. You can see the script execution result logged on your repository's Actions tab:

   {
   "entries": [
   {
      "key": "secret",
      "textValue": "67cH2£?pO********"
   }
   ],
   "versionId": "e6q8isknpcp7********"
   }
   

Delete the resources you createdDelete the resources you created

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them:

• Yandex Lockbox secret
• Service account

See alsoSee also

• Secure storage of GitLab CI passwords as Yandex Lockbox secrets