TerraformでAWSにGitHub Actions用のOIDCプロバイダーを作成する

locals {
  github_oidc_role_name = "github-actions-role"
}

module "iam_github_oidc_provider" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-provider"
  version = "5.17.0"
}

// [!code word:example-org/example-repo]
module "iam_github_oidc_role" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-role"
  version = "5.17.0"

  name = local.github_oidc_role_name

  subjects = [
    "example-org/example-repo:*",
  ]

  policies = {
    additional = aws_iam_policy.github_oidc_role_policy.arn
  }
}

resource "aws_iam_policy" "github_oidc_role_policy" {
  name        = "${local.github_oidc_role_name}-policy"
  description = "GitHub actions policy"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        "Effect" : "Allow",
        "Action" : "*",
        "Resource" : "*"
      }
    ]
  })
}