Package: aws-cdk-github-oidc
AWS CDK Github OpenID ConnectAWSCDKconstructs that define:Github Actions as OpenID Connect Identity Provider into AWS IAMIAM Roles that can be assumed by Github Actions workflowsThese constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.Background informationGitHub Actions: Secure cloud deployments with OpenID Connecton Github Changelog Blog.Security hardening your deploymentson Github Docs.Assuming a role withaws-actions/configure-aws-credentials.Shout-out toRichard H. Boydfor helping me to debug Github OIDC setup with AWS IAM and hisDeploying to AWS with Github Actions-talk.Shout-out toAidan W Steeleand his blog postAWS federation comes to GitHub Actionsfor being the original inspiration for this.Getting startednpmi-Daws-cdk-github-oidcOpenID Connect Identity Provider trust for AWS IAMTo create a new Github OIDC provider configuration into AWS IAM:import{GithubActionsIdentityProvider}from"aws-cdk-github-oidc";constprovider=newGithubActionsIdentityProvider(scope,"GithubProvider");In the background this creates an OIDC provider trust configuration into AWS IAM with anissuer URL ofhttps://token.actions.githubusercontent.comand audiences (client IDs) configured as['sts.amazonaws.com'](which matches theaws-actions/configure-aws-credentialsimplementation).Retrieving a reference to an existing Github OIDC provider configurationRemember,there can be only one (Github OIDC provider per AWS Account), so to retrieve a reference to existing Github OIDC provider usefromAccountstatic method:import{GithubActionsIdentityProvider}from"aws-cdk-github-oidc";constprovider=GithubActionsIdentityProvider.fromAccount(scope,"GithubProvider");Defining a role for Github Actions workflow to assumeimport{GithubActionsRole}from"aws-cdk-github-oidc";constuploadRole=newGithubActionsRole(scope,"UploadRole",{provider:provider,//referenceintotheOIDCproviderowner:"octo-org",//yourrepositoryowner(organizationoruser)namerepo:"octo-repo",//yourrepositoryname(withouttheownername)filter:"ref:refs/tags/v*",//JWTsubsuffixfilter,defaultsto'*'});//useitlikeanyotherrole,forexamplegrantS3bucketwriteaccess:myBucket.grantWrite(uploadRole);You may pass in anyiam.RolePropsinto the construct's props, exceptassumedBywhich will be defined by this construct (CDK will fail if you do):constdeployRole=newGithubActionsRole(scope,"DeployRole",{provider:provider,owner:"octo-org",repo:"octo-repo",roleName:"MyDeployRole",description:"This role deploys stuff to AWS",maxSessionDuration:cdk.Duration.hours(2),});//Youmayalsousevarious"add*"policymethods!//"AdministratorAccess"notreallyagoodidea,justforanexamplehere:deployRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess"));Subject FilterBy default the value offilterproperty will be'*'which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on theexamples in Github Docs; For example:filtervalueDescrition'ref:refs/tags/v*'Allow only tags with prefix ofv'ref:refs/heads/demo-branch'Allow only from branchdemo-branch'pull_request'Allow only from pull request'environment:Production'Allow only fromProductionenvironmentGithub Actions WorkflowTo actually utilize this in your Github Actions workflow, useaws-actions/configure-aws-credentialstoassume a role.At the moment you must use themasterversion (until AWS releases a new tag):jobs:deploy:name:Upload to Amazon S3runs-on:ubuntu-latestpermissions:id-token:write# needed to interact with GitHub's OIDC Token endpoint.contents:readsteps:-name:Checkoutuses:actions/checkout@v2-name:Configure AWS credentialsuses:aws-actions/configure-aws-credentials@masterwith:role-to-assume:arn:aws:iam::123456789012:role/MyUploadRole#role-session-name: MySessionName # Optionalaws-region:us-east-1-name:Sync files to S3run:|aws s3 sync . s3://my-example-bucket