mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
7b31344988
These items fix the github action for use with the updates to the monitoring module. Additionally there were some changes needed to the monitoring module to make it behave inside the GH action. Once this is approved/merged, the new tag for them monitoring module will be created as `tf-mod-addon-monitoring-v1.1.1`
105 lines
2.4 KiB
HCL
105 lines
2.4 KiB
HCL
data "tls_certificate" "github" {
|
|
url = "https://token.actions.githubusercontent.com/.well-known/openid-configuration"
|
|
}
|
|
|
|
/*
|
|
It's possible to use the following to add Github as an OpenID Connect Provider and integrate
|
|
Github Actions as your CI/CD mechanism.
|
|
*/
|
|
|
|
resource "aws_iam_openid_connect_provider" "github" {
|
|
url = "https://token.actions.githubusercontent.com"
|
|
|
|
client_id_list = [
|
|
"sts.amazonaws.com",
|
|
]
|
|
|
|
|
|
thumbprint_list = [
|
|
data.tls_certificate.github.certificates[0].sha1_fingerprint
|
|
]
|
|
}
|
|
|
|
resource "aws_iam_role" "gha_role" {
|
|
name = "github-actions-role"
|
|
assume_role_policy = data.aws_iam_policy_document.gha_assume_role.json
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "gha_role_policy" {
|
|
policy = data.aws_iam_policy_document.gha-permissions.json
|
|
role = aws_iam_role.gha_role.id
|
|
}
|
|
|
|
|
|
#####################
|
|
# AssumeRole
|
|
#
|
|
# Allow sts:AssumeRoleWithWebIdentity from GitHub via OIDC
|
|
# Customize your repository
|
|
#####################
|
|
data "aws_iam_policy_document" "gha_assume_role" {
|
|
statement {
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRoleWithWebIdentity"]
|
|
principals {
|
|
type = "Federated"
|
|
identifiers = [
|
|
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/token.actions.githubusercontent.com"
|
|
]
|
|
}
|
|
condition {
|
|
test = "StringLike"
|
|
variable = "token.actions.githubusercontent.com:sub"
|
|
values = ["repo:fleetdm/fleet:*"]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:aud"
|
|
values = ["sts.amazonaws.com"]
|
|
}
|
|
}
|
|
}
|
|
// Customize the permissions for your deployment
|
|
data "aws_iam_policy_document" "gha-permissions" {
|
|
statement {
|
|
effect = "Allow"
|
|
actions = [
|
|
"ec2:*",
|
|
"cloudwatch:*",
|
|
"s3:*",
|
|
"lambda:*",
|
|
"ecs:*",
|
|
"rds:*",
|
|
"rds-data:*",
|
|
"secretsmanager:*",
|
|
"pi:*",
|
|
"ecr:*",
|
|
"iam:*",
|
|
"aps:*",
|
|
"vpc:*",
|
|
"kms:*",
|
|
"elasticloadbalancing:*",
|
|
"ce:*",
|
|
"cur:*",
|
|
"logs:*",
|
|
"cloudformation:*",
|
|
"ssm:*",
|
|
"sns:*",
|
|
"elasticache:*",
|
|
"application-autoscaling:*",
|
|
"acm:*",
|
|
"route53:*",
|
|
"dynamodb:*",
|
|
"kinesis:*",
|
|
"firehose:*",
|
|
"athena:*",
|
|
"glue:*",
|
|
"ses:*",
|
|
"wafv2:*",
|
|
"events:*",
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
}
|