/github-oidc-example-granular-permissions

Github OpenID Connect with granular permissions

Primary LanguageHCL

Github OpenID connect with AWS (Granular permissions)

This is an example of Github Actions deployment to AWS with OpenID connect (OIDC) using terraform.

Building on our example. We address a few problems related to permissions where it works for all workflows (pull requests, all branches and forks).

We want more granularity, which is what we are doing here.

Changes

So, there are a few things we need to change:

  • Create Separate the IAM roles (one for pull request, and deployment)
  • Update our Subject filter and the condition operators
  • Separate github actions workflows (pull request and deployment)

Separate roles

Deployment (write only)

Deployment role

Pull request (read only)

Pull request role

Full Tutorial

Full article available at jerrychang.ca - Security harden Github Action deployments to AWS with OIDC