oidc_role

oidc_role

locals {
  github_repos = toset( [for repo in var.github_lambda_repos : join("", ["repo:santander-group-uk/", repo, ":*"])] )
}


## Role for the service account
resource "aws_iam_role" "Github-EKS-Deploy" {
  name                 = "local-github-eks-deploy-ole"
  permissions_boundary = "arn:aws:iam::${var.account_id}:policy/AccountAutomation_policy_and_boundary"
  description          = "role to deploy to eks"
  path                 = "/"

  force_detach_policies = true

  assume_role_policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Effect" : "Allow",
          "Principal" : {
            "Federated" : "arn:aws:iam::${var.account_id}:oidc-provider/token.actions.githubusercontent.com"
          },
          "Action" : "sts:AssumeRoleWithWebIdentity",
          "Condition" : {
            "ForAnyValue:StringLike" : {
              "token.actions.githubusercontent.com:sub" : local.github_repos
            }
          }
        }
      ]
  }
  {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "eks.amazonaws.com"
          ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
)
}

resource "aws_iam_policy" "eks_deploy_policy" {
  name   = "local-eks-deploy-Policy"
  policy = file("${path.module}/policies/eks_deploy_policy.json")
}

resource "aws_iam_role_policy_attachment" "eks_deploy" {
  policy_arn = aws_iam_policy.eks_deploy_policy.arn
  role       = aws_iam_role.github-eks-deploy.name
}