mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
7b7bb16dc4
# Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md) - [ ] Documented any permissions changes - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features. - [ ] Added/updated tests - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
104 lines
2.3 KiB
HCL
104 lines
2.3 KiB
HCL
data "tls_certificate" "github" {
|
|
url = "https://token.actions.githubusercontent.com/.well-known/openid-configuration"
|
|
}
|
|
|
|
/*
|
|
It's possible to use the following to add Github as an OpenID Connect Provider and integrate
|
|
Github Actions as your CI/CD mechanism.
|
|
*/
|
|
|
|
resource "aws_iam_openid_connect_provider" "github" {
|
|
url = "https://token.actions.githubusercontent.com"
|
|
|
|
client_id_list = [
|
|
"sts.amazonaws.com",
|
|
]
|
|
|
|
|
|
thumbprint_list = [
|
|
data.tls_certificate.github.certificates[0].sha1_fingerprint
|
|
]
|
|
}
|
|
|
|
resource "aws_iam_role" "gha_role" {
|
|
name = "github-actions-role"
|
|
assume_role_policy = data.aws_iam_policy_document.gha_assume_role.json
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "gha_role_policy" {
|
|
policy = data.aws_iam_policy_document.gha-permissions.json
|
|
role = aws_iam_role.gha_role.id
|
|
}
|
|
|
|
|
|
#####################
|
|
# AssumeRole
|
|
#
|
|
# Allow sts:AssumeRoleWithWebIdentity from GitHub via OIDC
|
|
# Customize your repository
|
|
#####################
|
|
data "aws_iam_policy_document" "gha_assume_role" {
|
|
statement {
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRoleWithWebIdentity"]
|
|
principals {
|
|
type = "Federated"
|
|
identifiers = [
|
|
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/token.actions.githubusercontent.com"
|
|
]
|
|
}
|
|
condition {
|
|
test = "StringLike"
|
|
variable = "token.actions.githubusercontent.com:sub"
|
|
values = ["repo:fleetdm/fleet:*"]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:aud"
|
|
values = ["sts.amazonaws.com"]
|
|
}
|
|
}
|
|
}
|
|
// Customize the permissions for your deployment
|
|
data "aws_iam_policy_document" "gha-permissions" {
|
|
statement {
|
|
effect = "Allow"
|
|
actions = [
|
|
"ec2:*",
|
|
"cloudwatch:*",
|
|
"s3:*",
|
|
"lambda:*",
|
|
"ecs:*",
|
|
"rds:*",
|
|
"rds-data:*",
|
|
"secretsmanager:*",
|
|
"pi:*",
|
|
"ecr:*",
|
|
"iam:*",
|
|
"aps:*",
|
|
"vpc:*",
|
|
"kms:*",
|
|
"elasticloadbalancing:*",
|
|
"ce:*",
|
|
"cur:*",
|
|
"logs:*",
|
|
"cloudformation:*",
|
|
"ssm:*",
|
|
"sns:*",
|
|
"elasticache:*",
|
|
"application-autoscaling:*",
|
|
"acm:*",
|
|
"route53:*",
|
|
"dynamodb:*",
|
|
"kinesis:*",
|
|
"firehose:*",
|
|
"athena:*",
|
|
"glue:*",
|
|
"ses:*",
|
|
"wafv2:*",
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
}
|