Merge pull request #42 from byu-oit/gha-oidc

use oidc for gha aws configuration

Author: joshgubler

.github/workflows/ci.yml

@@ -17,20 +17,20 @@ jobs:
               {
                 "tf_version":"0.13.2",
                 "tf_working_dir":"./examples/ci-0_13",
-                "aws_key_name":"byu_oit_terraform_dev_key",
-                "aws_secret_name":"byu_oit_terraform_dev_secret"
+                "aws_account":"977306314792",
+                "aws_gha_role":"terraform-lambda-api-dev-gha"
               },
               {
                 "tf_version":"0.14.8",
                 "tf_working_dir":"./examples/ci-0_14",
-                "aws_key_name":"byu_oit_terraform_dev_key",
-                "aws_secret_name":"byu_oit_terraform_dev_secret"
+                "aws_account":"977306314792",
+                "aws_gha_role":"terraform-lambda-api-dev-gha"
               },
               {
                 "tf_version":"1.0.0",
                 "tf_working_dir":"./examples/ci-1",
-                "aws_key_name":"byu_oit_terraform_dev_key",
-                "aws_secret_name":"byu_oit_terraform_dev_secret"
+                "aws_account":"977306314792",
+                "aws_gha_role":"terraform-lambda-api-dev-gha"
               }
             ]
           }'
@@ -65,14 +65,15 @@ jobs:
       contents: read
       actions: read
       pull-requests: write
+      id-token: write
     steps:
       - uses: actions/checkout@v3
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v2
         with:
-          aws-access-key-id: ${{ secrets[matrix.env.aws_key_name] }}
-          aws-secret-access-key: ${{ secrets[matrix.env.aws_secret_name] }}
+          role-to-assume: "arn:aws:iam::${{ matrix.env.aws_account }}:role/${{ matrix.env.aws_gha_role }}"
+          role-session-name: ${{ github.sha }}
           aws-region: us-west-2
 
       - name: Terraform Setup

terraform-setup/.terraform.lock.hcl

@@ -0,0 +1,51 @@
+terraform {
+  required_version = "1.5.2"
+  backend "s3" {
+    bucket         = "terraform-state-storage-977306314792"
+    dynamodb_table = "terraform-state-lock-977306314792"
+    key            = "terraform-aws-lambda-api/setup.tfstate"
+    region         = "us-west-2"
+  }
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 4.67"
+    }
+  }
+}
+
+locals {
+  name    = "terraform-lambda-api"
+  gh_org  = "byu-oit"
+  gh_repo = "terraform-aws-lambda-api"
+  env     = "dev"
+}
+
+provider "aws" {
+  region = "us-west-2"
+
+  default_tags {
+    tags = {
+      repo                   = "https://github.com/byu-oit/terraform-aws-lambda-api"
+      data-sensitivity       = "public"
+      env                    = local.env
+      resource-creator-email = "GitHub-Actions"
+    }
+  }
+}
+
+module "acs" {
+  source = "github.com/byu-oit/terraform-aws-acs-info?ref=v4.0.0"
+}
+
+module "gha_role" {
+  source                         = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
+  version                        = "5.17.0"
+  create_role                    = true
+  role_name                      = "${local.name}-${local.env}-gha"
+  provider_url                   = module.acs.github_oidc_provider.url
+  role_permissions_boundary_arn  = module.acs.role_permissions_boundary.arn
+  role_policy_arns               = module.acs.power_builder_policies[*].arn
+  oidc_fully_qualified_audiences = ["sts.amazonaws.com"]
+  oidc_subjects_with_wildcards   = ["repo:${local.gh_org}/${local.gh_repo}:*"]
+}