cdk-github-oidc

Inspired by aripalo/aws-cdk-github-oidc, this construct library allows you to create a Github OpenID Connect Identity Provider trust relationship with the Provider construct as well as federated IAM roles for one or multiple Github repositories.

This construct is still in experimental stage and may have breaking changes. However, we aim to make this library as simple as possible.

Sample

1import { Provider } from '@pahud/cdk-github-oidc';
2
3// create a new provider
4const provider = new Provider(stack, 'GithubOpenIdConnectProvider')
5// create an IAM role from this provider
6provider.createRole('demo-role', 
7  // sharing this role across multiple repositories
8  [
9    { owner: 'octo-org', repo: 'first-repo' },
10    { owner: 'octo-org', repo: 'second-repo' },
11    { owner: 'octo-org', repo: 'third-repo' },
12  ]
13)

Import the provider

Each AWS account can only have one GitHub OIDC identity provider. To import the existing one, use Provider.fromAccount():

1// import the provider
2const provider = Provider.fromAccount(stack, 'GithubOpenIdConnectProvider')
3// create a iam role from the imported provider
4provider.createRole(...)

Workflow sample

1name: demo
2on:
3  workflow_dispatch: {}
4jobs:
5  deploy:
6    name: Upload to Amazon S3
7    runs-on: ubuntu-latest
8    env:
9      AWS_REGION: us-east-1
10    permissions:
11      id-token: write # needed to interact with GitHub's OIDC Token endpoint.
12      contents: read
13    steps:
14    - name: Checkout
15      uses: actions/checkout@v2
16
17    - name: Configure AWS credentials
18      uses: aws-actions/configure-aws-credentials@master
19      with:
20        role-to-assume: ${{ secrets.AWS_ROLE_ARN_TO_ASSUME }}
21        aws-region: ${{ env.AWS_REGION }}
22
23    - name: Sync files to S3
24      run: |
25        aws s3 sync ./ s3://${{ secrets.AWS_BUCKET }}

Projects using this library

• pahud/gitpod-workspace
• pahud/github-codespace
• pahud/vscode

Reference

• Configuring OpenID Connect in Amazon Web Services from GitHub Docs
• aripalo/aws-cdk-github-oidc by Ari Palo