terraform-aws-github-oidc

Purpose

Terraform module to create a GitHub OIDC provider and the associated IAM roles. This enables GitHub Actions to access resources within an AWS account without requiring long-lived credentials to be stored as GitHub secrets.

Features

• Create an AWS OIDC provider for GitHub Actions

• Create one or more IAM role that can be assumed by GitHub Actions include buildin and custom roles:

  • AWS security scan role (build in)
  • AWS ECR publisher role (build in)
  • Custom role

• IAM roles can be scoped to :

  • One or more GitHub repository

Usage

module "github_oidc_buildinRole" {
  source = "source = "git@github.com:oozou/terraform-aws-github-oidc.git?ref=<ref_id>"
  github_repositories=["oozou/terraform-aws-test1","oozou/terraform-aws-test2"]
  is_create_securityscan_oicd_role=true
  is_create_ecrpush_oicd_role=true
  environment = "dev"
  prefix = "oozou-sandbox"
  
}

module "github_oidc_custom" {
  depends_on = [module.github_oidc_buildinRole]
  source = "source = "git@github.com:oozou/terraform-aws-github-oidc.git?ref=<ref_id>"
  custom_role_name_prefix="S3_ReadOnly"
  github_repositories=["oozou/terraform-aws-xxx"]
  is_create_custom_oicd_role=true
  is_create_oidc_provider=false
  custom_role_iam_policy_arns=["arn:aws:iam::aws:policy/ReadOnlyAccess"]
  custom_iam_role_inline_policies = {
    "example_inline_policy" : data.aws_iam_policy_document.example.json
  }
  environment = "dev"
  prefix = "oozou-sandbox"
  
}

data "aws_iam_policy_document" "example" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["*"]
  }
}

Requirements

Name	Version
terraform	>= 1.0.0
aws	>= 4.0.0
tls	~> 3.4.0

Providers

Name	Version
aws	>= 4.0.0
tls	~> 3.4.0

Modules

No modules.

Resources

Name	Type
aws_iam_openid_connect_provider.this	resource
aws_iam_role.custom	resource
aws_iam_role.ecrpush	resource
aws_iam_role.ecs	resource
aws_iam_role.securityscan	resource
aws_iam_role_policy_attachment.custom	resource
aws_iam_role_policy_attachment.ecr_poweruser	resource
aws_iam_role_policy_attachment.ecs_ecrpoweruser	resource
aws_iam_role_policy_attachment.ecs_fulladmin	resource
aws_iam_role_policy_attachment.securityscan_ecr_readonly	resource
aws_iam_role_policy_attachment.securityscan_readonly	resource
aws_iam_role_policy_attachment.securityscan_securityaudit	resource
aws_iam_openid_connect_provider.github	data source
aws_iam_policy_document.federated_assume_policy	data source
tls_certificate.github_actions_oidc_endpoint	data source

Inputs

Name	Description	Type	Default	Required
custom_iam_role_inline_policies	Inline policies map with policy name as key and json as value.	map(string)	{}	no
custom_role_iam_policy_arns	AWS built in policies for custom role	list(string)	[]	no
custom_role_name_prefix	IAM role name to be <role_name>-GithubOIDCRole	string	"custom"	no
ecr_poweruser_policy_arn	AWS built in ECR PowerUser access policy arn	string	"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser"	no
ecr_readonly_policy_arn	AWS built in ECR readonly access policy arn	string	"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"	no
ecrpush_role_name_prefix	IAM role name to be <role_name>-GithubOIDCRole	string	"ECR_ReadWrite"	no
ecs_fullaccess_policy_arn	AWS built in ECS full access policy arn	string	"arn:aws:iam::aws:policy/AmazonECS_FullAccess"	no
ecs_role_name_prefix	IAM role name to be <role_name>-GithubOIDCRole	string	"ECS_FullAccess"	no
environment	Environment Variable used as a prefix	string	n/a	yes
force_detach_policies	Flag to force detachment of policies attached to the IAM role.	string	false	no
github_actions_oidc_url	The URL to use for the OIDC handshake	string	"https://token.actions.githubusercontent.com"	no
github_repositories	List of GitHub organization/repository names authorized to assume the role.	list(string)	n/a	yes
github_thumbprint	GitHub OpenID TLS certificate thumbprint.	string	"6938fd4d98bab03faadb97b34396831e3780aea1"	no
iam_role_path	Path under which to create IAM role.	string	"/"	no
iam_role_permissions_boundary	ARN of the permissions boundary to be used by the IAM role.	string	""	no
is_create_custom_oicd_role	Whether to create custom oidc role	bool	false	no
is_create_ecrpush_oicd_role	Whether to create ecr readwrite oidc role	bool	false	no
is_create_ecs_oicd_role	Whether to create ecs full access oidc role	bool	false	no
is_create_github_oidc	Flag to enable/disable the creation of GitHub OIDC resources.	bool	true	no
is_create_oidc_provider	Flag to enable/disable the creation of the GitHub OIDC provider.	bool	true	no
is_create_securityscan_oicd_role	Whether to create securityscan oidc role	bool	false	no
max_session_duration	Maximum session duration in seconds.	number	3600	no
prefix	The prefix name of customer to be displayed in AWS console and resource	string	n/a	yes
readonly_policy_arn	AWS built in readonly access policy arn	string	"arn:aws:iam::aws:policy/ReadOnlyAccess"	no
role_name_suffix	IAM role name to be <role_name><role_name_suffix>	string	"GithubOIDCRole"	no
securityaudit_policy_arn	AWS built in securityaudit access policy arn	string	"arn:aws:iam::aws:policy/SecurityAudit"	no
securityscan_role_name_prefix	IAM role name to be <role_name>-GithubOIDCRole	string	"SecurityScan"	no
tags	Custom tags which can be passed on to the AWS resources. They should be key value pairs having distinct keys	map(any)	{}	no

Outputs

Name	Description
aws_iam_openid_connect_provider_arn	ARN of the Github oidc provider.
custom_iam_role_arn	ARN of the IAM role.
ecrpush_iam_role_arn	ARN of the IAM role.
securityscan_iam_role_arn	ARN of the IAM role.