This module allows users to create an OIDC Provider and the associated IAM resources required to make use of the connect provider.
module "github-oidc-provider" {
source = "https://github.com/ministryofjustice/modernisation-platform-terraform-github-oidc-provider"
github_repositories = ["ministryofjustice/your-repository-name:*"]
additional_permissions = data.aws_iam_policy_document.extra_permissions.json
tags_common = local.tags
tags_prefix = terraform.workspace
}
The additional_permissions
variable will allow you to supply any required IAM permissions beyond ReadOnlyAccess
in the form of
an aws_iam_policy_document
data call.
If you're looking to raise an issue with this module, please create a new issue in the Modernisation Platform repository.
Name | Version |
---|---|
terraform | >= 1.0.1 |
aws | ~> 5.0 |
tls | ~> 4.0 |
Name | Version |
---|---|
aws | ~> 5.0 |
tls | ~> 4.0 |
No modules.
Name | Type |
---|---|
aws_iam_openid_connect_provider.github_actions | resource |
aws_iam_policy.extra_permissions | resource |
aws_iam_role.github_actions | resource |
aws_iam_role_policy_attachment.additional_managed_policies | resource |
aws_iam_role_policy_attachment.extra_permissions | resource |
aws_iam_role_policy_attachment.read_only | resource |
aws_caller_identity.current | data source |
aws_iam_policy_document.github_oidc_assume_role | data source |
tls_certificate.github | data source |
Name | Description | Type | Default | Required |
---|---|---|---|---|
additional_managed_policies | accept a list of arns for aws managed policies to attach to OIDC-provider role | list(string) |
[] |
no |
additional_permissions | accept aws_iam_policy_document with additional permissions to attach to the OIDC-provider role | string |
n/a | yes |
github_known_thumbprints | The known intermediary thumbprints for the GitHub OIDC provider | list(string) |
[ |
no |
github_repositories | The github repositories, for example ["ministryofjustice/modernisation-platform-environments:*"] | list(string) |
n/a | yes |
role_name | OIDC Role Name | string |
"github-actions" |
no |
tags_common | MOJ required tags | map(string) |
n/a | yes |
tags_prefix | prefix for name tags | string |
n/a | yes |
Name | Description |
---|---|
github_actions_provider | This module configures an OIDC provider for use with GitHub actions |
github_actions_role | IAM Role created for use by the OIDC provider |
github_actions_role_trust_policy | Assume role policy for the github-actions role |