cdk-github-oidc
Inspired by aripalo/aws-cdk-github-oidc, this construct library allows you to create a Github OpenID Connect Identity Provider trust relationship with the Provider construct as well as federated IAM roles for one or multiple Github repositories.
This construct is still in experimental stage and may have breaking changes. However, we aim to make this library as simple as possible.
Sample
import { Provider } from '@pahud/cdk-github-oidc';
// create a new provider
const provider = new Provider(stack, 'GithubOpenIdConnectProvider')
// create an IAM role from this provider
provider.createRole('demo-role',
// sharing this role across multiple repositories
[
{ owner: 'octo-org', repo: 'first-repo' },
{ owner: 'octo-org', repo: 'second-repo' },
{ owner: 'octo-org', repo: 'third-repo' },
]
)
Import the provider
Each AWS account can only have one GitHub OIDC identity provider. To import the existing one, use Provider.fromAccount():
// import the provider
const provider = Provider.fromAccount(stack, 'GithubOpenIdConnectProvider')
// create a iam role from the imported provider
provider.createRole(...)
Workflow sample
name: demo
on:
workflow_dispatch: {}
jobs:
deploy:
name: Upload to Amazon S3
runs-on: ubuntu-latest
env:
AWS_REGION: us-east-1
permissions:
id-token: write # needed to interact with GitHub's OIDC Token endpoint.
contents: read
steps:
- name: Checkout
uses: actions/checkout@v2
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@master
with:
role-to-assume: ${{ secrets.AWS_ROLE_ARN_TO_ASSUME }}
aws-region: ${{ env.AWS_REGION }}
- name: Sync files to S3
run: |
aws s3 sync ./ s3://${{ secrets.AWS_BUCKET }}
Projects using this library
Reference
- Configuring OpenID Connect in Amazon Web Services from GitHub Docs
- aripalo/aws-cdk-github-oidc by Ari Palo
1 maintainer
Metadata
1 maintainer
Release files for pahud-cdk-github-oidc 0.0.387
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| pahud-cdk-github-oidc-0.0.387.tar.gz | 36.3 kB | Without provenance | Details for pahud-cdk-github-oidc-0.0.387.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| pahud_cdk_github_oidc-0.0.387-py3-none-any.whl | Python 3 | none | any | Details for pahud_cdk_github_oidc-0.0.387-py3-none-any.whl |
Total release size: 71.0 kB
Release files / pahud-cdk-github-oidc-0.0.387.tar.gz
| Download URL | pahud-cdk-github-oidc-0.0.387.tar.gz |
|---|---|
| Size | 36.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
0667036a51d1c5242090ce9fab88ccdb62cdcc41896f65bc03d8da174387f11c
|
|
BLAKE2b-256 checksum How to use checksums |
4098daeab18afc22b956f4bb7b0e9035b404899c10d7f55702b76257f88c808f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.11.2
|
Release files / pahud_cdk_github_oidc-0.0.387-py3-none-any.whl
| Download URL | pahud_cdk_github_oidc-0.0.387-py3-none-any.whl |
|---|---|
| Size | 34.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
0ff7a3881cfb0eb747658b0cc119dc63df40beb44d038613b66cf82fe9d070ba
|
|
BLAKE2b-256 checksum How to use checksums |
7a5e550957bf7fadd44ba18e03fce521172894fcb0904810193abd4bde5fe0ab
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.11.2
|
Security for pahud-cdk-github-oidc 0.0.387
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
