diff --git a/CHANGELOG.md b/CHANGELOG.md index a36ec17..4add4a9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,11 @@ Notable changes to this project are documented in this changelog. This project adheres to the [semantic versioning] specification. +## [1.6.0] – 2023-09-07 + +- Allow additional audiences to be specified ([d5f4644](https://github.com/unfunco/terraform-aws-oidc-github/commit/d5f46444ed4018b88d0204df037ac3b4dbca7a03)) +- Add IAM role name to outputs ([2ef5c27](https://github.com/unfunco/terraform-aws-oidc-github/commit/2ef5c27980657505c0e00d8665e57fa5c885785b)) + ## [1.5.2] – 2023-06-29 - Discard the order of thumbprints ([5fae63a](https://github.com/unfunco/terraform-aws-oidc-github/commit/5fae63a23c87a59839453df6b04956babd32734e)) @@ -127,4 +132,5 @@ This project adheres to the [semantic versioning] specification. [1.5.0]: https://github.com/unfunco/terraform-aws-oidc-github/compare/v1.4.0...v1.5.0 [1.5.1]: https://github.com/unfunco/terraform-aws-oidc-github/compare/v1.5.0...v1.5.1 [1.5.2]: https://github.com/unfunco/terraform-aws-oidc-github/compare/v1.5.1...v1.5.2 +[1.6.0]: https://github.com/unfunco/terraform-aws-oidc-github/compare/v1.5.2...v1.6.0 [semantic versioning]: https://semver.org diff --git a/README.md b/README.md index 3946298..310c293 100644 --- a/README.md +++ b/README.md @@ -7,12 +7,14 @@ Terraform module to configure GitHub Actions as an IAM OIDC identity provider in AWS. OpenID Connect allows GitHub Actions workflows to access resources in AWS -without requiring the AWS credentials as to be stored long-lived GitHub secrets. +without requiring AWS credentials to be stored as long-lived GitHub secrets. ## 🔨 Getting started ### Requirements +- [AWS Provider] 4.0+ +- [TLS Provider] 3.0+ - [Terraform] 1.0+ ### Installation and usage @@ -28,7 +30,7 @@ provider "aws" { module "oidc_github" { source = "unfunco/oidc-github/aws" - version = "1.5.2" + version = "1.6.0" github_repositories = [ "org/repo", @@ -88,6 +90,7 @@ applied, the JWT will contain an updated `iss` claim. | Name | Description | Type | Default | Required | | ----------------------------- | --------------------------------------------------------------------------- | -------------- | ---------- | :------: | +| additional_audiences | List of additional OIDC audiences allowed to assume the role. | `list(string)` | `null` | no | | additional_thumbprints | List of additional thumbprints for the OIDC provider. | `list(string)` | `null` | no | | attach_admin_policy | Flag to enable/disable the attachment of the AdministratorAccess policy. | `bool` | `false` | no | | attach_read_only_policy | Flag to enable/disable the attachment of the ReadOnly policy. | `bool` | `true` | no | @@ -106,9 +109,10 @@ applied, the JWT will contain an updated `iss` claim. ## Outputs -| Name | Description | -| ------------ | -------------------- | -| iam_role_arn | ARN of the IAM role. | +| Name | Description | +| ------------- | --------------------- | +| iam_role_arn | ARN of the IAM role. | +| iam_role_name | Name of the IAM role. | @@ -117,6 +121,7 @@ applied, the JWT will contain an updated `iss` claim. - [Configuring OpenID Connect in Amazon Web Services] - [Creating OpenID Connect (OIDC) identity providers] - [Obtaining the thumbprint for an OpenID Connect Identity Provider] +- [GitHub Actions – Update on OIDC integration with AWS] ## License @@ -124,9 +129,12 @@ applied, the JWT will contain an updated `iss` claim. Made available under the terms of the [Apache License 2.0]. [apache license 2.0]: LICENSE.md +[aws provider]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs [complete example]: examples/complete [configuring openid connect in amazon web services]: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services [creating openid connect (oidc) identity providers]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html [make]: https://www.gnu.org/software/make/ [obtaining the thumbprint for an openid connect identity provider]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html [terraform]: https://www.terraform.io +[tls provider]: https://registry.terraform.io/providers/hashicorp/tls/latest/docs +[github actions – update on oidc integration with aws]: https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/ diff --git a/data.tf b/data.tf index a27b2c9..b9a21b9 100644 --- a/data.tf +++ b/data.tf @@ -32,7 +32,7 @@ data "aws_iam_policy_document" "assume_role" { condition { test = "StringEquals" - values = ["sts.amazonaws.com"] + values = var.additional_audiences != null ? concat(["sts.amazonaws.com"], var.additional_audiences) : ["sts.amazonaws.com"] variable = "token.actions.githubusercontent.com:aud" } diff --git a/examples/complete/main.tf b/examples/complete/main.tf index ac04090..84d1bc1 100644 --- a/examples/complete/main.tf +++ b/examples/complete/main.tf @@ -7,6 +7,7 @@ module "aws_oidc_github" { enabled = var.enabled + additional_audiences = var.additional_audiences additional_thumbprints = var.additional_thumbprints attach_admin_policy = var.attach_admin_policy attach_read_only_policy = var.attach_read_only_policy diff --git a/examples/complete/variables.tf b/examples/complete/variables.tf index 96c8fd1..a3b98fe 100644 --- a/examples/complete/variables.tf +++ b/examples/complete/variables.tf @@ -1,3 +1,9 @@ +variable "additional_audiences" { + default = null + description = "List of additional OIDC audiences allowed to assume the role." + type = list(string) +} + variable "additional_thumbprints" { default = null description = "List of additional thumbprints for the OIDC provider." diff --git a/main.tf b/main.tf index 15b0f63..cc51d25 100644 --- a/main.tf +++ b/main.tf @@ -77,13 +77,12 @@ resource "aws_iam_openid_connect_provider" "github" { tags = var.tags url = "https://token.actions.githubusercontent.com%{if var.enterprise_slug != ""}/${var.enterprise_slug}%{endif}" - thumbprint_list = var.additional_thumbprints != null ? toset( + thumbprint_list = toset(var.additional_thumbprints != null ? concat( local.known_thumbprints, [data.tls_certificate.github.certificates[0].sha1_fingerprint], - [for thumbprint in var.additional_thumbprints : thumbprint], - ) - ) : toset( + var.additional_thumbprints, + ) : concat( local.known_thumbprints, [data.tls_certificate.github.certificates[0].sha1_fingerprint], diff --git a/outputs.tf b/outputs.tf index 29ebf3a..ec56701 100644 --- a/outputs.tf +++ b/outputs.tf @@ -17,3 +17,9 @@ output "iam_role_arn" { description = "ARN of the IAM role." value = var.enabled ? aws_iam_role.github[0].arn : "" } + +output "iam_role_name" { + depends_on = [aws_iam_role.github] + description = "Name of the IAM role." + value = var.enabled ? aws_iam_role.github[0].name : "" +} diff --git a/variables.tf b/variables.tf index bba0891..5746f14 100644 --- a/variables.tf +++ b/variables.tf @@ -12,6 +12,12 @@ // See the License for the specific language governing permissions and // limitations under the License. +variable "additional_audiences" { + default = null + description = "List of additional OIDC audiences allowed to assume the role." + type = list(string) +} + variable "additional_thumbprints" { default = null description = "List of additional thumbprints for the OIDC provider."