Package: cdk-circleci-oidc
CircleCI OIDCThis repository contains constructs to communicate between CircleCI and AWS via an Open ID Connect (OIDC) provider.
The process is described inthis CircleCI blog post.Security BenefitsBy using the OpenID Connect provider, you can communicate with AWS from CircleCI without saving static credentials
(e.g.,AWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEY) in your CircleCI project settings or a context. Removing
static credentials, especially in light of the early 2023breach,
is a best practice for security.Quick StartInstall the package:npminstall@blimmer/cdk-circleci-oidc

or

yarnadd@blimmer/cdk-circleci-oidcThen, create the provider and role(s).import{Stack,StackProps}from'aws-cdk-lib';import{CircleCiOidcProvider,CircleCiOidcRole}from'@blimmer/cdk-circleci-oidc';import{Construct}from'constructs';import{ManagedPolicy,PolicyStatement}from'aws-cdk-lib/aws-iam';import{Bucket}from'aws-cdk-lib/aws-s3';exportclassCircleCiStackextendsStack{constructor(scope:Construct,id:string,props?:StackProps){super(scope,id,props);constprovider=newCircleCiOidcProvider(this,'OidcProvider',{//FindyourorganizationIDintheCircleCIdashboardunder"Organization Settings"organizationId:'11111111-2222-3333-4444-555555555555',});constmyCircleCiRole=newCircleCiOidcRole(this,'MyCircleCiRole',{circleCiOidcProvider:provider,roleName:"MyCircleCiRole",//PasssomemanagedpoliciestotherolemanagedPolicies:[ManagedPolicy.fromAwsManagedPolicyName('AmazonS3ReadOnlyAccess'),],})//Youcanalsoaccesstherolefromtheconstruct.Thisallowsaddingrolesandusing`grant`methodsafterthe//constructhasbeencreated.myCircleCiRole.role.addToPolicy(newPolicyStatement({actions:['s3:ListAllMyBuckets'],resources:['*'],}));constbucket=newBucket(this,'MyBucket');bucket.grantRead(myCircleCiRole.role);}}Now, in your.circleci/config.ymlfile, you can use theAWS CLI Orbto assume your new role.version:2.1orbs:aws-cli:circleci/aws-cli@4.1.0# https://circleci.com/developer/orbs/orb/circleci/aws-cliworkflows:version:2build:jobs:-oidc-job:context:oidc-assumption# You _must_ use a context, even if it doesn't contain any secrets (see https://circleci.com/docs/openid-connect-tokens/#openid-connect-id-token-availability)jobs:oidc-job:docker:-image:cimg/base:stablesteps:-checkout# https://circleci.com/developer/orbs/orb/circleci/aws-cli#commands-setup-aws-cli/setup:role_arn:'arn:aws:iam::123456789101:role/MyCircleCiRole'-run:name:List S3 Bucketscommand:aws s3 lsCross Stack UsageIf you want to use the OIDC provider in another stack, you can use thegetProviderForExportmethod.import{Stack,StackProps}from'aws-cdk-lib';import{CircleCiOidcProvider}from'@blimmer/cdk-circleci-oidc';import{Construct}from'constructs';exportclassCircleCiStackextendsStack{readonlycircleCiOidcProvider:ManualCircleCiOidcProviderProps;//exportforuseinotherstacksconstructor(scope:Construct,id:string,props?:StackProps){super(scope,id,props);constprovider=newCircleCiOidcProvider(this,'OidcProvider',{//FindyourorganizationIDintheCircleCIdashboardunder"Organization Settings"organizationId:'11111111-2222-3333-4444-555555555555',});this.circleCiOidcProvider=provider.getProviderForExport(this.account);}}import{Stack,StackProps}from'aws-cdk-lib';import{CircleCiOidcRole}from'@blimmer/cdk-circleci-oidc';import{Construct}from'constructs';importtype{CircleCiStack}from'./CircleCiStack';interfaceConsumingStackProps{circleci:CircleCi;}exportclassConsumingStackextendsStack{constructor(scope:Construct,id:string,props:ConsumingStackProps){super(scope,id,props);const{circleCiOidcProvider}=props.circleci;constmyCircleCiRole=newCircleCiOidcRole(this,'MyCircleCiRole',{circleCiOidcProvider,roleName:"MyCircleCiRole",})}}UsageFor detailed API docs, seeAPI.md.PythonThis package is available for Python ascdk-circleci-oidc.pipinstallcdk-circleci-oidcContributingContributions, issues, and feedback are welcome!