generated from clouddrove/terraform-module-template
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: created terarform module for aws github oidc role (#47)
* feat: created terarform module for aws github oidc role * feat: Added aws_github_oidc_role module example * feat: Added aws_github_oidc_role module example * fix- tflint issue on acm * feat:Added varaibles values in terraform.tfvars folder
- Loading branch information
1 parent
59536d9
commit b72f7b7
Showing
9 changed files
with
325 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,76 @@ | ||
# Terraform Configuration for AWS IAM GitHub OIDC Role | ||
|
||
Creates an IAM role that trust the IAM GitHub OIDC provider. | ||
|
||
## Prerequisites | ||
|
||
Before using this configuration, make sure you have the following prerequisites: | ||
|
||
- [Terraform](https://www.terraform.io/) installed on your local machine. | ||
- Appropriate AWS credentials and permissions to create IAM resources. | ||
|
||
## Example | ||
```bash | ||
module "aws_oidc_role" { | ||
source = "git@github.com:clouddrove/terraform-aws-control-tower?ref=master" | ||
|
||
# Module input variables | ||
vpn_enable = false | ||
route53_enable = false | ||
acm_enable = false | ||
tgw_spoke_enable = false | ||
tgw_hub_enable = false | ||
sg_enable = false | ||
subnet_enable = false | ||
vpc_enable = false | ||
iam_github_oidc_role_enable = true | ||
provider_url = "https://token.actions.githubusercontent.com" | ||
oidc_github_repos = ["username/reponame"] | ||
role_name = "GitHub-Deploy-Role" | ||
oidc_provider_exists = false | ||
name = "app" | ||
repository = "repository-name" | ||
environment = "control-tower" | ||
managedby = "hello@clouddrove.com" | ||
} | ||
``` | ||
|
||
4. Initialize the Terraform working directory: | ||
|
||
```bash | ||
terraform init | ||
|
||
5. Review the Terraform plan: | ||
|
||
```bash | ||
terraform plan | ||
5. Apply the configuration to create the AWS resources: | ||
```bash | ||
terraform apply | ||
|
||
6. Confirm the changes by typing yes when prompted. | ||
7. The configuration will create the specified IAM Role and OpenID Connect Provider. If var.enable is set to true, it will also attach the AdministratorAccess policy to the IAM Role. | ||
|
||
## Inputs | ||
|
||
| Name | Description | Type | Default | Required | | ||
|------|-------------|------|---------|:--------:| | ||
| iam_github_oidc_role_enable | Whether to create AWS oidc GitHUb role or not. | `bool` | false | yes | | ||
| oidc_provider_exists | Mention oidc provider exist or not in true or false. | `bool` | false | yes | | ||
| role_name | Role name . | `string` | `GitHub-Deploy-Role` | yes | | ||
| oidc_github_repos | GitHub repository to set IAM Role conditions . | `list(string)` | `""` | yes | | ||
| provider_url | URL for the OIDC provider. | `string` | `https://token.actions.githubusercontent.com` | yes | | ||
| environment | Environment for tag, (e.g. `prod`, `dev`, `staging`). | `string` | `""` | yes | | ||
| managedby | ManagedBy for tag, eg 'CloudDrove' | `string` | `"hello@clouddrove.com"` | yes | | ||
| name | Name for tag (e.g. `app` or `cluster`). | `string` | `""` | yes | | ||
| repository | repsoitory name for tag| `string` | `""` | yes | | ||
| policy_arns | A list of ARNs of policies to attach to the IAM role| `list(string)` | `["arn:aws:iam::aws:policy/AdministratorAccess"]` | yes | | ||
|
||
## Cleanup | ||
1. To destroy the created resources, run: | ||
```bash | ||
terraform destroy | ||
2. Confirm the destruction by typing yes when prompted. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,63 @@ | ||
locals { | ||
tags = { | ||
"name" = var.name | ||
"repository" = var.repository | ||
"environment" = var.environment | ||
"managedby" = var.managedby | ||
} | ||
} | ||
|
||
data "tls_certificate" "github" { | ||
count = var.enable ? 1 : 0 | ||
url = var.provider_url | ||
} | ||
|
||
data "aws_iam_openid_connect_provider" "github" { | ||
count = var.enable && var.oidc_provider_exists ? 1 : 0 | ||
url = var.provider_url | ||
} | ||
|
||
resource "aws_iam_openid_connect_provider" "github" { | ||
count = var.enable && !var.oidc_provider_exists ? 1 : 0 | ||
client_id_list = ["sts.amazonaws.com"] | ||
thumbprint_list = [data.tls_certificate.github[0].certificates[0].sha1_fingerprint] | ||
url = var.provider_url | ||
tags = local.tags | ||
} | ||
|
||
# Include the role resource and attachment here | ||
|
||
resource "aws_iam_role" "github" { | ||
count = var.enable ? 1 : 0 | ||
name = var.role_name | ||
tags = local.tags | ||
assume_role_policy = jsonencode({ | ||
Version = "2012-10-17", | ||
Statement = [ | ||
{ | ||
Effect = "Allow", | ||
Principal = { | ||
Federated = var.oidc_provider_exists ? data.aws_iam_openid_connect_provider.github[0].arn : aws_iam_openid_connect_provider.github[0].arn | ||
|
||
}, | ||
Action = "sts:AssumeRoleWithWebIdentity", | ||
Condition = { | ||
StringEquals = { | ||
"token.actions.githubusercontent.com:aud" = "sts.amazonaws.com" | ||
}, | ||
"ForAnyValue:StringLike" = { | ||
"token.actions.githubusercontent.com:sub" = [ | ||
for repo in var.oidc_github_repos : "repo:${repo}:*" | ||
] | ||
} | ||
} | ||
} | ||
] | ||
}) | ||
} | ||
|
||
resource "aws_iam_role_policy_attachment" "github" { | ||
count = var.enable ? length(var.policy_arns) : 0 | ||
role = aws_iam_role.github[0].name | ||
policy_arn = var.policy_arns[count.index] | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,53 @@ | ||
variable "name" { | ||
type = string | ||
description = "Name for tags" | ||
} | ||
|
||
variable "repository" { | ||
type = string | ||
default = "https://github.com/clouddrove/terraform-aws-control-tower.git" | ||
description = "Repository name for tags" | ||
} | ||
|
||
variable "environment" { | ||
type = string | ||
description = "Environment name for tags" | ||
} | ||
|
||
variable "managedby" { | ||
type = string | ||
default = "hello@clouddrove.com" | ||
description = "Managed by for tags" | ||
} | ||
|
||
variable "provider_url" { | ||
type = string | ||
description = "URL for the OIDC provider" | ||
} | ||
|
||
variable "oidc_github_repos" { | ||
type = list(string) | ||
description = "GitHub repository names for access" | ||
} | ||
|
||
variable "role_name" { | ||
type = string | ||
description = "Name of the AWS IAM Role to create" | ||
} | ||
|
||
variable "enable" { | ||
type = bool | ||
default = true | ||
description = "Create aws oidc GitHUb role or not" | ||
} | ||
|
||
variable "oidc_provider_exists" { | ||
type = bool | ||
default = true | ||
description = "Mention oidc provider exist or not in true or false" | ||
} | ||
|
||
variable "policy_arns" { | ||
type = list(string) | ||
description = "A list of ARNs of policies to attach to the IAM role." | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,16 @@ | ||
# ------------------------------------------------------------------------------ | ||
# Versions | ||
# ------------------------------------------------------------------------------ | ||
terraform { | ||
required_version = ">= 1.4.6" | ||
required_providers { | ||
aws = { | ||
source = "hashicorp/aws" | ||
version = ">= 5.1.0" | ||
} | ||
tls = { | ||
source = "hashicorp/tls" | ||
version = ">= 3.0" | ||
} | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters