Skip to content

Instantly share code, notes, and snippets.

@timmyers
Created October 4, 2022 01:04
Show Gist options
  • Save timmyers/e46a41cd9eef6e1d33b071f375d7ba37 to your computer and use it in GitHub Desktop.
Save timmyers/e46a41cd9eef6e1d33b071f375d7ba37 to your computer and use it in GitHub Desktop.
Pulumi IaC Github IAM Role
import * as aws from '@pulumi/aws';
const defaultTags = { Creator: 'pulumi' };
const githubOIDC = new aws.iam.OpenIdConnectProvider('github', {
url: 'https://token.actions.githubusercontent.com',
thumbprintLists: ['15e29108718111e59b3dad31954647e3c344a231'],
clientIdLists: ['sts.amazonaws.com'],
tags: defaultTags,
});
const githubRole = new aws.iam.Role('github', {
name: 'github',
assumeRolePolicy: {
Version: '2012-10-17',
Statement: [{
Effect: 'Allow',
Action: 'sts:AssumeRoleWithWebIdentity',
Principal: {
Federated: githubOIDC.arn,
},
Condition: {
StringLike: {
'token.actions.githubusercontent.com:sub': 'repo:timmyers/fearless:*',
},
'ForAllValues:StringEquals': {
'token.actions.githubusercontent.com:iss': 'https://token.actions.githubusercontent.com',
'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
},
},
}],
},
tags: defaultTags,
});
new aws.iam.RolePolicy('github', {
role: githubRole.name,
name: 'github',
policy: {
Version: '2012-10-17',
Statement: [{
Effect: 'Allow',
Action: 'sts:AssumeRole',
Resource: infrastructureRole.arn,
}],
},
});
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment