aws-tf-modules/github-oidc-iam-role/data.tf at 1e4eb505fa08cf8217b310bfc9504ae1a25db426 · Script47/aws-tf-modules · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
data "aws_iam_openid_connect_provider" "github" {
  url      = "https://token.actions.githubusercontent.com"
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    effect = "Allow"

    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type = "Federated"
      identifiers = [data.aws_iam_openid_connect_provider.github.arn]
    }

    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }

    dynamic "condition" {
      for_each = length(var.repo_owners) > 0 ? [1] : []

      content {
        test     = "StringEquals"
        variable = "token.actions.githubusercontent.com:repository_owner"
        values   = var.repo_owners
      }
    }

    dynamic "condition" {
      for_each = length(var.sub) > 0 ? [1] : []

      content {
        test     = "StringLike"
        variable = "token.actions.githubusercontent.com:sub"
        values   = var.sub
      }
    }
  }
}