GitHub OIDC for AWS Authentication Terraform

deploy.yml

name: build and push

on:
    release:
        types: [published]

jobs:
    docker:
        runs-on: ubuntu-latest
        permissions:
            id-token: write
            contents: read
        steps:
            - uses: actions/checkout@v3

            - name: Configure AWS credentials
              uses: aws-actions/configure-aws-credentials@v2
              with:
                  role-to-assume: ${{ secrets.ASSUME_ROLE }}
                  aws-region: us-east-1
                  mask-aws-account-id: yes

            - name: Login to Amazon ECR
              id: login-ecr
              uses: aws-actions/amazon-ecr-login@v1

            - name: Build, tag, and push image to Amazon ECR
              env:
                  ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
                  ECR_REPOSITORY: techmove-bot
                  IMAGE_TAG: ${{ github.ref_name }}
                  STATIC_TAG: latest
              run: |
                  DOCKER_BUILDKIT=1 docker build -q -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -t $ECR_REGISTRY/$ECR_REPOSITORY:$STATIC_TAG -f Dockerfile .
                  docker push $ECR_REGISTRY/$ECR_REPOSITORY --all-tags

ecr.tf

resource "aws_ecr_repository" "this" {
  name                 = local.project
  image_tag_mutability = "MUTABLE"
  image_scanning_configuration {
    scan_on_push = true
  }
}

data "aws_iam_policy_document" "ecr" {
  statement {
    sid    = "ECRGetAuthToken"
    effect = "Allow"
    actions = [
      "ecr:GetAuthorizationToken",
    ]
    resources = ["*"]
  }

  statement {
    sid    = "ECRWritePermissions"
    effect = "Allow"
    actions = [
      "ecr:BatchCheckLayerAvailability",
      "ecr:CompleteLayerUpload",
      "ecr:InitiateLayerUpload",
      "ecr:PutImage",
      "ecr:UploadLayerPart",
    ]
    resources = [aws_ecr_repository.this.arn]
  }
}

github-oidc.tf

locals {
  github_oidc_domain = "token.actions.githubusercontent.com"
  reponame           = "repo:lays147/techmove-bot:ref:refs/tags/*"
}


resource "aws_iam_openid_connect_provider" "default" {
  url             = "https://${local.github_oidc_domain}"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    sid     = "Github"
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]
    principals {
      type        = "Federated"
      identifiers = [aws_iam_openid_connect_provider.default.arn]
    }
    condition {
      test     = "StringEquals"
      variable = "${local.github_oidc_domain}:aud"
      values   = ["sts.amazonaws.com"]
    }
    condition {
      test     = "StringLike"
      variable = "${local.github_oidc_domain}:sub"
      values   = [local.reponame]
    }
  }
}

resource "aws_iam_role" "this" {
  name               = "${local.project}-assume-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

resource "aws_iam_role_policy" "ecr" {
  name   = "${local.project}-ecr-policy"
  role   = aws_iam_role.this.name
  policy = data.aws_iam_policy_document.ecr.json
}