| 1 | terraform { |
| 2 | required_providers { |
| 3 | aws = { |
| 4 | source = "hashicorp/aws" |
| 5 | } |
| 6 | } |
| 7 | } |
| 8 | |
| 9 | variable "subject_filter" { |
| 10 | type = list(string) |
| 11 | } |
| 12 | |
| 13 | data "aws_caller_identity" "current" {} |
| 14 | |
| 15 | data "aws_iam_openid_connect_provider" "github_actions" { |
| 16 | url = "https://token.actions.githubusercontent.com" |
| 17 | } |
| 18 | |
| 19 | data "aws_iam_policy_document" "assume_github_actions" { |
| 20 | |
| 21 | statement { |
| 22 | effect = "Allow" |
| 23 | actions = ["sts:AssumeRoleWithWebIdentity"] |
| 24 | |
| 25 | principals { |
| 26 | type = "Federated" |
| 27 | identifiers = [data.aws_iam_openid_connect_provider.github_actions.arn] |
| 28 | } |
| 29 | |
| 30 | condition { |
| 31 | test = "StringLike" |
| 32 | variable = "token.actions.githubusercontent.com:sub" |
| 33 | values = var.subject_filter |
| 34 | } |
| 35 | } |
| 36 | } |
| 37 | |
| 38 | output "json" { |
| 39 | value = data.aws_iam_policy_document.assume_github_actions.json |
| 40 | } |