Skip to content

Commit 91e1daf

Browse files
bryan-rhmbryan-rhm
authored
[v1.0.0] Initial module implementation (#1)
* [v1.0.0] initial module implementation
1 parent 7004f0b commit 91e1daf

File tree

6 files changed

+221
-1
lines changed

6 files changed

+221
-1
lines changed

‎.gitignore

+4
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,7 @@ override.tf.json
2727

2828
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
2929
# example: *tfplan*
30+
31+
.terraform.lock.hcl
32+
33+
.terraform

‎README.md

+115-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,116 @@
11
# terraform-aws-github-oidc
2-
Module to create github oidc integration.
2+
Module to create github oidc integration with AWS.
3+
4+
## Usage
5+
6+
### Install the module
7+
8+
Initialize the module and get the Role ARN from the outputs.
9+
10+
```hcl
11+
provider "aws" {
12+
region = var.region
13+
}
14+
15+
module "github_oidc" {
16+
source = "bryan-rhm/github-oidc/aws"
17+
version = "1.0.0"
18+
19+
github_organization = "YOUR ORGANIZATION/GITHUB ACCOUNT"
20+
managed_policy_arns = ["arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"] # Policies you want to attach to the github role.
21+
22+
}
23+
```
24+
25+
Once you have installed the module you will be able authenticate from your github organization using the role created from the module.
26+
27+
The job or workflow run requires a permissions setting with id-token: write. You won't be able to request the OIDC JWT ID token if the permissions setting for id-token is set to read or none.
28+
29+
```yaml
30+
permissions:
31+
id-token: write
32+
```
33+
34+
The aws-actions/configure-aws-credentials action receives a JWT from the GitHub OIDC provider, and then requests an access token from AWS. For more information, see the [AWS documentation](https://github.com/aws-actions/configure-aws-credentials).
35+
36+
```yaml
37+
# Sample workflow to access AWS resources when workflow is tied to branch
38+
# The workflow Creates static website using aws s3
39+
name: AWS example workflow
40+
on:
41+
push
42+
env:
43+
BUCKET_NAME : "<example-bucket-name>"
44+
AWS_REGION : "<example-aws-region>"
45+
# permission can be added at job level or workflow level
46+
permissions:
47+
id-token: write
48+
contents: read # This is required for actions/checkout
49+
jobs:
50+
S3PackageUpload:
51+
runs-on: ubuntu-latest
52+
steps:
53+
- name: Git clone the repository
54+
uses: actions/checkout@v3
55+
- name: configure aws credentials
56+
uses: aws-actions/configure-aws-credentials@v1
57+
with:
58+
role-to-assume: arn:aws:iam::1234567890:role/example-role
59+
role-session-name: samplerolesession
60+
aws-region: ${{ env.AWS_REGION }}
61+
# Upload a file to AWS s3
62+
- name: Copy index.html to s3
63+
run: |
64+
aws s3 cp ./index.html s3://${{ env.BUCKET_NAME }}/
65+
```
66+
67+
68+
### References
69+
[Configuring OpenID Connect in Amazon Web Services](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)
70+
71+
## Requirements
72+
73+
| Name | Version |
74+
|------|---------|
75+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.4 |
76+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.43.0 |
77+
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 3.4.0 |
78+
79+
## Providers
80+
81+
| Name | Version |
82+
|------|---------|
83+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.19.0 |
84+
| <a name="provider_tls"></a> [tls](#provider\_tls) | 3.4.0 |
85+
86+
## Modules
87+
88+
No modules.
89+
90+
## Resources
91+
92+
| Name | Type |
93+
|------|------|
94+
| [aws_iam_openid_connect_provider.oidc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
95+
| [aws_iam_role.role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
96+
| [aws_iam_policy_document.asume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
97+
| [tls_certificate.certificate](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/data-sources/certificate) | data source |
98+
99+
## Inputs
100+
101+
| Name | Description | Type | Default | Required |
102+
|------|-------------|------|---------|:--------:|
103+
| <a name="input_github_organization"></a> [github\_organization](#input\_github\_organization) | The GitHub organization to allow access to | `string` | n/a | yes |
104+
| <a name="input_github_repositories"></a> [github\_repositories](#input\_github\_repositories) | The GitHub repositories inside the organization you want to allow access to | `list(string)` | <pre>[<br> "*"<br>]</pre> | no |
105+
| <a name="input_github_url"></a> [github\_url](#input\_github\_url) | The URL of the GitHub OAuth2 provider | `string` | `"https://token.actions.githubusercontent.com"` | no |
106+
| <a name="input_managed_policy_arns"></a> [managed\_policy\_arns](#input\_managed\_policy\_arns) | The ARNs of the managed policies to attach to the role | `list(string)` | `[]` | no |
107+
| <a name="input_role_name"></a> [role\_name](#input\_role\_name) | Name of the IAM role | `string` | `"GithubActionsRole"` | no |
108+
| <a name="input_tags"></a> [tags](#input\_tags) | Tags to apply to all resources | `map(string)` | `{}` | no |
109+
110+
## Outputs
111+
112+
| Name | Description |
113+
|------|-------------|
114+
| <a name="output_assume_role_policy"></a> [assume\_role\_policy](#output\_assume\_role\_policy) | Assume role policy, this value can be used to create another role outside this module |
115+
| <a name="output_oidc"></a> [oidc](#output\_oidc) | Github openid connect provider |
116+
| <a name="output_role_arn"></a> [role\_arn](#output\_role\_arn) | Arn of the IAM role allowed to authenticate to AWS from Github actions |

‎main.tf

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
resource "aws_iam_openid_connect_provider" "oidc" {
2+
url = var.github_url
3+
client_id_list = ["sts.amazonaws.com"]
4+
thumbprint_list = [data.tls_certificate.certificate.certificates.0.sha1_fingerprint]
5+
}
6+
7+
data "tls_certificate" "certificate" {
8+
url = var.github_url
9+
}
10+
11+
resource "aws_iam_role" "role" {
12+
assume_role_policy = data.aws_iam_policy_document.asume_role_policy.json
13+
name = var.role_name
14+
managed_policy_arns = var.managed_policy_arns
15+
force_detach_policies = true
16+
}
17+
18+
data "aws_iam_policy_document" "asume_role_policy" {
19+
statement {
20+
actions = ["sts:AssumeRoleWithWebIdentity"]
21+
effect = "Allow"
22+
23+
condition {
24+
test = "StringLike"
25+
variable = "${replace(aws_iam_openid_connect_provider.oidc.url, "https://", "")}:sub"
26+
values = [ for repo in var.github_repositories : "repo:${var.github_organization}/${repo}:*" ]
27+
}
28+
condition {
29+
test = "StringEquals"
30+
variable = "${replace(aws_iam_openid_connect_provider.oidc.url, "https://", "")}:aud"
31+
values = ["sts.amazonaws.com"]
32+
}
33+
34+
principals {
35+
identifiers = [aws_iam_openid_connect_provider.oidc.arn]
36+
type = "Federated"
37+
}
38+
}
39+
}
40+

‎outputs.tf

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
output "role_arn" {
2+
description = "Arn of the IAM role allowed to authenticate to AWS from Github actions"
3+
value = aws_iam_role.role.arn
4+
}
5+
6+
output "oidc" {
7+
description = "Github openid connect provider"
8+
value = aws_iam_openid_connect_provider.oidc
9+
}
10+
11+
output "assume_role_policy" {
12+
description = "Assume role policy, this value can be used to create another role outside this module"
13+
value = data.aws_iam_policy_document.asume_role_policy.json
14+
}

‎variables.tf

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
variable "github_url" {
2+
description = "The URL of the GitHub OAuth2 provider"
3+
default = "https://token.actions.githubusercontent.com"
4+
type = string
5+
}
6+
7+
variable "github_organization" {
8+
description = "The GitHub organization to allow access to"
9+
type = string
10+
}
11+
12+
variable "github_repositories" {
13+
description = "The GitHub repositories inside the organization you want to allow access to"
14+
default = ["*"]
15+
type = list(string)
16+
}
17+
18+
variable "role_name" {
19+
description = "Name of the IAM role"
20+
default = "GithubActionsRole"
21+
type = string
22+
}
23+
24+
variable "managed_policy_arns" {
25+
description = "The ARNs of the managed policies to attach to the role"
26+
default = []
27+
type = list(string)
28+
}
29+
30+
variable "tags" {
31+
description = "Tags to apply to all resources"
32+
default = {}
33+
type = map(string)
34+
}

‎versions.tf

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">= 0.13.4"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 3.43.0"
8+
}
9+
tls = {
10+
source = "hashicorp/tls"
11+
version = ">= 3.4.0"
12+
}
13+
}
14+
}

0 commit comments

Comments
 (0)