gh-action-open-id-in-aws 1.0.1

Setup GitHub action Open ID connect for AWS made easy.

---

Welcome to gh_action_open_id_in_aws Documentation

To use GitHub Actions to deploy applications to AWS, we have to setup the permission properly.

The old school method is to use Secret Environment Variable to store the AWS IAM User credentials. You can store access key abd secret key to the AWS_ACCESS_KEY_ID 和 AWS_SECRET_ACCESS_KEY environment variables. This is also the solution used by CircleCI.

Around Nov 2021, AWS and GitHub made the official Open ID Connection (OIDC) available. It simplifies the process of granting AWS permissions to GitHub Actions. This is the AWS recommended way, and AWS explicitly mentioned that it is NOT recommended to use long term IAM user credential for CI/CD.

This Python tool automates the process of setting up the GitHub action open id connection in AWS.

Reference:

• Configuring OpenID Connect in Amazon Web Services: GitHub official doc.

• Sample IAM OIDC CloudFormation Template: AWS maintained github action.

Developer Guide

This section is for developers who want to contribute to this project.

What under the hood is a CloudFormation template. The gh_action_open_id_in_aws/cf.py file contains the AWS CDK source code. The cdk/cdk_synth.py script can generate the JSON CloudFormation template using AWS CDK. The developer then can copy the output template to the gh_action_open_id_in_aws/cft-{year}-{month}-{day}.json file and do local testing.

Install

gh_action_open_id_in_aws is released on PyPI, so all you need is to:

$ pip install gh-action-open-id-in-aws

To upgrade to latest version:

$ pip install --upgrade gh-action-open-id-in-aws