Github OIDC Provider

This module setups an AWS OIDC Identity prodiver for Github Actions. This will allow you to use OIDC Federation to give your Github Actions access to your AWS account.

Main Doc: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services

Filtering on the sub

Conditions to validate

Doc: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#examples

This controls can help you do things like:

• Only allow a certain branch
• Only allow a certain repo/org
• Allow certain branch patterns (note: the default values may clash)

ARN to use in the Github Actions

This module outputs an arn value. This is the arn you should use in the Github Actions.

Requirements

No requirements.

Providers

Name	Version
aws	n/a

Modules

Name	Source	Version
iam_assumable_role_admin	terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc	3.6.0

Resources

Name	Type
aws_iam_openid_connect_provider.this	resource
aws_iam_policy.iam_policy	resource

Inputs

Name	Description	Type	Default	Required
aws_policy_json	The AWS policy in a json format	string	"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": \"*\",\n \"Resource\": \"*\"\n }\n ]\n}\n"	no
client_id_list	n/a	list	[ "sts.amazonaws.com" ]	no
create_identity_provider	This switch allows you to create or not create the identity provider. Only one can exist. If you are creating multiple Github OIDC Federations, only one of the instantiations should create this or the Terraform run will fail.	bool	true	no
name	The name for the various resources	string	"github_oidc"	no
tags	Tags	map(any)	{}	no
thumbprint_list	This is the thumbprint returned if you were to create an "identity provider" in AWS and gave it this url: https://token.actions.githubusercontent.com	list	[ "a031c46782e6e6c662c2c87c76da9aa62ccabd8e" ]	no
url	n/a	string	"https://token.actions.githubusercontent.com"	no
validate_conditions	Conditions to validate	set(string)	[ "repo:octo-org/octo-repo:ref:refs/heads/octo-branch" ]	no
validate_wildcard_conditions	Conditions to validate that include wildcards	set(string)	[ "repo:octo-org/octo-repo:ref:refs/heads/feature/*" ]	no

Outputs

Name	Description
arn	n/a