devops-security/terraform/aws-gha-oidc-providers.tf at 27f1c8c311a7729481d810574ba723d9fb43a7ab · hackforla/devops-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
module "iam_oidc_gha_incubator" {
  source = "./modules/aws-gha-oidc-providers"

  role_name     = "gha-incubator"
  use_wildcard  = true
  github_branch = "refs/heads/*" # allows any branch
  github_repo   = "hackforla/incubator"

  policy_arns = [
    "arn:aws:iam::aws:policy/AdministratorAccess"
  ]

}
resource "aws_iam_role" "incubator_tf_plan" {
  name = "incubator-tf-plan"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = "sts:AssumeRoleWithWebIdentity"
        Principal = {
          Federated = module.iam_oidc_gha_incubator.provider_arn
        }
        Condition = {
          StringEquals = {
            "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
          }
          StringLike = {
            "token.actions.githubusercontent.com:sub" = [
              "repo:hackforla/incubator:ref:refs/heads/*",
              "repo:hackforla/incubator:pull_request"
            ]
          }
        }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "incubator_tf_plan_readonly" {
  role      = aws_iam_role.incubator_tf_plan.name
  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
}

resource "aws_iam_role" "incubator_tf_apply" {
  name = "incubator-tf-apply"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = "sts:AssumeRoleWithWebIdentity"
        Principal = {
          Federated = module.iam_oidc_gha_incubator.provider_arn
        }
        Condition = {
          StringEquals = {
            "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
          }
          StringLike = {
            "token.actions.githubusercontent.com:sub" = [
              "repo:hackforla/incubator:ref:refs/heads/main"
            ]
          }
        }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "incubator_tf_apply_admin" {
  role       = aws_iam_role.incubator_tf_apply.name
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}