GitHub Actions AWS Federation in CDK

github-federation.ts

import { App, Construct, Stack, StackProps } from '@aws-cdk/core';

import * as iam from '@aws-cdk/aws-iam';

const repo = "aws-cdk";
const owner = "aws";

export class GithubFederation extends Stack {
  constructor(scope: Construct, id: string, props: StackProps = {}) {
    super(scope, id, props);

    const githubOIDC = new iam.CfnOIDCProvider(this, "GitHubOIDC", {
      url: "https://vstoken.actions.githubusercontent.com",
      clientIdList: ["sigstore"],
      thumbprintList: ["a031c46782e6e6c662c2c87c76da9aa62ccabd8e"]
    })

    new iam.Role(this, 'ExampleGithubRole', {
      roleName: "ExampleGithubRole",
      assumedBy: new iam.WebIdentityPrincipal(githubOIDC.ref, {
        "StringLike": {
          "vstoken.actions.githubusercontent.com:sub": `repo:${owner}/${repo}:*`
        }
      }),
    })
}};