GitHub Enterprise AWS OIDC

gistfile1.txt

---

AWSTemplateFormatVersion: 2010-09-09
Description: GitHub Actions AWS Authentication with OIDC for GitHub Enterprise

Parameters:
  GithubOrg: # can also be a regular user
    Type: String
    Default: mygithuborg
  FullRepoName:
    Type: String
    Default: mygithuborg/sjramblings

Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ExampleGithubRole
      ManagedPolicyArns: [arn:aws:iam::aws:policy/ReadOnlyAccess]
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRoleWithWebIdentity
            Principal:
              Federated: !Ref GithubOidc
            Condition:
              StringLike:
                mygithub.com/_services/token:aud: !Sub https://mygithub.com/${GithubOrg}
                mygithub.com/_services/token:sub: !Sub repo:${FullRepoName}:*

  GithubOidc:
    Type: AWS::IAM::OIDCProvider
    Properties:
      Url: https://mygithub.com/_services/token
      ThumbprintList: [6938fd4d98bab03faadb97b34396831e3780aea1]
      ClientIdList:
        - !Sub https://mygithub.com/${GithubOrg}

Outputs:
  Role:
    Value: !GetAtt Role.Arn