https://github.com/ministryofjustice/cloud-platform-iam-policy-github-action
A GitHub Action used with Pull requests (PRs) on the MoJ Cloud Platform.
https://github.com/ministryofjustice/cloud-platform-iam-policy-github-action
cloud-platform-engineering github-actions standards-compliant
Last synced: 2 months ago
JSON representation
A GitHub Action used with Pull requests (PRs) on the MoJ Cloud Platform.
- Host: GitHub
- URL: https://github.com/ministryofjustice/cloud-platform-iam-policy-github-action
- Owner: ministryofjustice
- License: mit
- Created: 2024-03-07T14:10:47.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2026-03-31T15:56:49.000Z (2 months ago)
- Last Synced: 2026-03-31T17:35:49.981Z (2 months ago)
- Topics: cloud-platform-engineering, github-actions, standards-compliant
- Language: Go
- Homepage:
- Size: 29.3 KB
- Stars: 0
- Watchers: 4
- Forks: 2
- Open Issues: 5
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
README
# IAM Role and Policy Changes Check GitHub Action
[](https://operations-engineering-reports.cloud-platform.service.justice.gov.uk/public-report/cloud-platform-iam-policy-github-action)
This GitHub Action is designed to identify and flag any pull requests within the [Ministry of Justice Cloud Platform][cloud-platform] that contain changes related to IAM roles and IAM policies. Such changes require approval from the Cloud Platform team to ensure compliance and security within the platform's infrastructure.
## Overview
This action automatically marks pull requests containing IAM role and policy changes as failed, signalling the need for a review by authorised team members. This process helps maintain the integrity and security of the IAM policies within the Cloud Platform.
## How to Use
To integrate this GitHub Action into your workflow, follow the steps below:
1. **Create a Workflow File:** In your repository, create a file named `.github/workflows/iam-role-policy-changes-check.yml`.
2. **Configure the Workflow:** Copy and paste the following workflow configuration into your new file:
```yaml
name: Identify PRs that contain IAM Role and Policy changes
on:
pull_request
env:
PR_OWNER: ${{ github.event.pull_request.user.login }}
GITHUB_OAUTH_TOKEN: ${{ secrets.DOCUMENT_REVIEW_GITHUB }}
PR_NUMBER: ${{ github.event.number }}
GITHUB_REPOSITORY: ${{ github.repository }}
GITHUB_APP_ID: ${{ secrets.GITHUB_APP_ID }}
GITHUB_APP_INSTALLATION_ID: ${{ secrets.GITHUB_APP_INSTALLATION_ID }}
GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
jobs:
check-diff:
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest]
steps:
- name: Checkout PR code
uses: actions/checkout@
- run: |
git fetch --no-tags --prune --depth=1 origin +refs/heads/*:refs/remotes/origin/*
- name: Run git diff against repository
run: |
git diff origin/main HEAD > changes
- name: Run iam/role policy changes check
id: review_pr
uses: ministryofjustice/cloud-platform-iam-policy-github-action@
```
3. **Provide Required Secret:** Ensure the `secrets.DOCUMENT_REVIEW_GITHUB` secret is set in your repository's settings to allow the action to operate correctly.
[cloud-platform]: https://github.com/ministryofjustice/cloud-platform-environments