{"repo":"aripalo/aws-cdk-github-oidc","free":true,"listed":false,"github":"https://github.com/aripalo/aws-cdk-github-oidc","clone":"git clone https://github.com/aripalo/aws-cdk-github-oidc.git","description":"CDK constructs to use OpenID Connect for authenticating your Github Action workflow with AWS IAM","language":"TypeScript","stars":127,"topics":["aws","cdk","aws-cdk","aws-cdk-construct","github","github-actions","iam","oidc","openid-connect","typescript"],"license":"Apache-2.0","category":"auth-billing-email","readme_excerpt":"[!IMPORTANT] Migrating to v4 ? See Migration Guide at the end of this README. AWS CDK Github OpenID Connect --- AWS CDK constructs that define: - Github Actions as OpenID Connect Identity Provider into AWS IAM - IAM Roles that can be assumed by Github Actions workflows These constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM. Background information - GitHub Actions: Secure cloud deployments with OpenID Connect on Github Changelog Blog. - Security hardening your deployments on Github Docs. - Assuming a role with aws-actions/configure-aws-credentials . - Shout-out to Richard H. Boyd for helping me to debug Github OIDC setup with AWS IAM and his Deploying to AWS with Github Actions-talk. - Shout-out to Aidan W Steele and his blog post AWS federation comes to GitHub Actions for being the original inspiration for this. Getting started OpenID Connect Identity Provider trust for AWS IAM To create a new Github OIDC provider configuration into AWS IAM: In the background this creates an OIDC provider trust configuration into AWS IAM with an issuer URL of https://token.actions.githubusercontent.com and audiences (client IDs) configured as ['sts.amazonaws.com'] (which matches the aws-actions/configure-aws-credentials implementation). Retrieving a reference to an existing Github OIDC provider configuration Remember, there","default_branch":null,"files":null,"tree":[],"storefront":"/r/aripalo","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/aripalo/aws-cdk-github-oidc/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}