Welcome to gh_action_open_id_in_aws Documentation
To use GitHub Actions to deploy applications to AWS, we have to setup the permission properly.
The old school method is to use Secret Environment Variable to store the AWS IAM User credentials. You can store access key abd secret key to the AWS_ACCESS_KEY_ID 和 AWS_SECRET_ACCESS_KEY environment variables. This is also the solution used by CircleCI.
Around Nov 2021, AWS and GitHub made the official Open ID Connection (OIDC) available. It simplifies the process of granting AWS permissions to GitHub Actions. This is the AWS recommended way, and AWS explicitly mentioned that it is NOT recommended to use long term IAM user credential for CI/CD.
This Python tool automates the process of setting up the GitHub action open id connection in AWS.
Reference:
Configuring OpenID Connect in Amazon Web Services: GitHub official doc.
Sample IAM OIDC CloudFormation Template: AWS maintained github action.
Developer Guide
This section is for developers who want to contribute to this project.
What under the hood is a CloudFormation template. The gh_action_open_id_in_aws/cf.py file contains the AWS CDK source code. The cdk/cdk_synth.py script can generate the JSON CloudFormation template using AWS CDK. The developer then can copy the output template to the gh_action_open_id_in_aws/cft-{year}-{month}-{day}.json file and do local testing.
Install
gh_action_open_id_in_aws is released on PyPI, so all you need is to:
$ pip install gh-action-open-id-in-awsTo upgrade to latest version:
$ pip install --upgrade gh-action-open-id-in-aws1 maintainer
Metadata
1 maintainer
Release files for gh-action-open-id-in-aws 1.0.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| gh_action_open_id_in_aws-1.0.1.tar.gz | 11.7 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| gh_action_open_id_in_aws-1.0.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 24.7 kB
Release files / gh_action_open_id_in_aws-1.0.1.tar.gz
| Download URL | gh_action_open_id_in_aws-1.0.1.tar.gz |
|---|---|
| Size | 11.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
30a7713d80769858f900d4cab87cea75c1d6d19fda7f777de744fd170b3aadd5
|
|
BLAKE2b-256 checksum How to use checksums |
006078a8abeb18265a2f77776d07700f88dba5e5a5a90980231b73da467feca0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.11.8
|
Release files / gh_action_open_id_in_aws-1.0.1-py3-none-any.whl
| Download URL | gh_action_open_id_in_aws-1.0.1-py3-none-any.whl |
|---|---|
| Size | 13.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
644ea79a3099f86fdadd6693f173e195d4cdf9845d050f5219a04d3d4bc43a24
|
|
BLAKE2b-256 checksum How to use checksums |
c8ab9669917f2ae1ea9fe012b9d2121ca75a63c1fdaf47fe232b8b9b94a7c71a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.11.8
|
