oidc-dev

A reference implementation of Configuring OpenID Connect in Amazon Web Services

Contents

oidc-cloudformation.yml: A cloudformation stack to be manually deployed to create an IAM Role that GitHub Actions can assume to deploy an application via CloudFormation

app-cloudformation.yml: The example application stack to be deployed via GitHub Actions

.github/workflows/deploy.yaml: The GitHub Actions workflow that assumes the OIDC IAM Role to deploy the application stack

Steps

1. Manually deploy oidc-cloudformation.yml
2. Create the AWS_DEFAULT_REGION, STACK_NAME, and OIDC_ROLE_ARN variables in Repository Settings -> Secrets and variables -> Actions
   1. OIDC_ROLE_ARN is the ARN of the IAM role created in step 1, available as an output of the OIDC stack
3. Run the deploy action via Workflow Dispatch to deploy the application stack