{"repo":"philips-labs/terraform-aws-github-oidc","free":true,"listed":false,"github":"https://github.com/philips-labs/terraform-aws-github-oidc","clone":"git clone https://github.com/philips-labs/terraform-aws-github-oidc.git","description":"Terraform module to setup OIDC with AWS and GH Actions","language":"HCL","stars":84,"topics":["terraform","iac","oidc","github-actions","aws","hacktoberfest"],"license":"MIT","category":"deployment-docker-iac","readme_excerpt":"Terraform module AWS OIDC integration GitHub Actions This Terraform module manages OpenID Connect (OIDC) integration between GitHub Actions and AWS. Description The module is strict on the claim checks to avoid that creating an OpenID connect integration opens your AWS account to any GitHub repo. However this strictness is not taking all the risk away. Ensure you familiarize yourself with OpenID Connect and the docs provided by GitHub and AWS. As always think about minimizing the privileges. The module can manage the following: - The OpenID Connect identity provider for GitHub in your AWS account (via a submodule). - A role and assume role policy to check to check OIDC claims. Manage the OIDC identity provider The module provides an option for creating an OpenID connect provider. Using the internal provider module to create the OpenID Connect provider. This configuration will create the provider and output the ARN. This output can be passed to other instances of the module to setup roles for repositories on the same provider. Alternative you can create the OpenID connect provider via the resource aws iam openid connect provider or in case you have an existing one look-up via the data source aws iam openid connect provider. Manage roles for a repo The module creates a role with an assume role policy to check the OIDC claims for the given repo. Be default the policy is set to only allow actions running on the main branch and deny pull request actions. You can choose based on yo","default_branch":null,"files":null,"tree":[],"storefront":"/r/philips-labs","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/philips-labs/terraform-aws-github-oidc/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}