https://github.com/babbel/terraform-aws-iam-role-for-github-repository

Terraform module creating an IAM role which can be assumed via OpenID by a GitHub-repository-specific GitHub Actions workflow
https://github.com/babbel/terraform-aws-iam-role-for-github-repository

aws terraform terraform-module

Last synced: 3 months ago
JSON representation

Terraform module creating an IAM role which can be assumed via OpenID by a GitHub-repository-specific GitHub Actions workflow

• Host: GitHub
• URL: https://github.com/babbel/terraform-aws-iam-role-for-github-repository
• Owner: babbel
• License: mit
• Created: 2022-04-21T10:48:08.000Z (about 4 years ago)
• Default Branch: main
• Last Pushed: 2026-02-28T00:02:27.000Z (4 months ago)
• Last Synced: 2026-03-02T09:46:26.689Z (4 months ago)
• Topics: aws, terraform, terraform-module
• Language: HCL
• Homepage: https://registry.terraform.io/modules/babbel/iam-role-for-github-repository/aws
• Size: 48.8 KB
• Stars: 3
• Watchers: 27
• Forks: 0
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • Changelog: CHANGELOG.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# AWS IAM Role Assumable via OpenID by GitHub Actions Workflows

Terraform module creating an IAM role which can be assumed via OpenID by a GitHub-repository-specific GitHub Actions workflow.

https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services

## Usage

```tf

module "iam_role" {

  source  = "babbel/iam-role-for-github-repository/aws"

  version = "~> 2.0"

  github_repository           = github_repository.example

  iam_openid_connect_provider = aws_iam_openid_connect_provider.github

}

resource "github_repository" "example" {

  name = "example"

}

resource "aws_iam_openid_connect_provider" "github" {

  url = data.tls_certificate.github.url

  client_id_list  = ["sts.amazonaws.com"]

  thumbprint_list = [local.github-certificate.sha1_fingerprint]

}

data "tls_certificate" "github" {

  url = "https://token.actions.githubusercontent.com"

}

locals {

  github-certificate = one([

    for certificate in data.tls_certificate.github.certificates :

    certificate

    if !certificate.is_ca

  ])

}

```