/mojo-aws-github-oidc-provider

To manage GitHub AWS OpenID Connector provider on MoJO AWS Shared Services account.

Primary LanguageHCLMIT LicenseMIT

repo standards badge

AWS GitHub OIDC Provider

An AWS Github OIDC provider is managed on MoJO Shared Services AWS account. This OIDC provider can be used in GitHub workflow action in any repositories in ministryofjustice GitHub organisation.

Make sure the repository is added in the locals.tf file in the github_repositories list.

Terraform will provide an output of the role-arn. This role-arn can be used as value for the role-to-assume attribute within a GitHub workflow in order to authenticate that workflow job against an AWS account.

This role-arn can also be stored as GitHub secret in any repository. Please refer to the github.tf file. You need to create a GitHub personal access token and store in the .env file in order to get this done or add to ~/.bash_aliases like this and no changes would be required to the .env.

export MYGITHUBTOKEN="ghp_96ac5bba9c9f054d6451ae50b55996b6"

How to use this

  1. Clone this repository in a directory on your developers workstation.
  2. Change your working directory to the newly created directory aws-github-oidc-provider.
  3. Copy the example env file cp .env.example .env
  4. Create a GitHub personal access token. Please use this guide if you need help.
  5. Add the token in the .env file or add to ~/.bash_aliases like as shown above
  6. Make sure the AWS_PROFILE values matches the AWS Cli profile name for the MoJO Shared Services AWS account on your workstation. It is recommended that you use MoJ Cloud Operations Team - Best practices guide to configure your AWS-Vault with AWS SSO.
  7. Make sure correct repositories are added in the github_repositories in the locals.tf file.
  8. Run make apply to apply terraform. See Makefile for more targets.