Pulumi IaC Github IAM Role

index.ts

import * as aws from '@pulumi/aws';

const defaultTags = { Creator: 'pulumi' };

const githubOIDC = new aws.iam.OpenIdConnectProvider('github', {
  url: 'https://token.actions.githubusercontent.com',
  thumbprintLists: ['15e29108718111e59b3dad31954647e3c344a231'],
  clientIdLists: ['sts.amazonaws.com'],
  tags: defaultTags,
});

const githubRole = new aws.iam.Role('github', {
  name: 'github',
  assumeRolePolicy: {
    Version: '2012-10-17',
    Statement: [{
      Effect: 'Allow',
      Action: 'sts:AssumeRoleWithWebIdentity',
      Principal: {
        Federated: githubOIDC.arn,
      },
      Condition: {
        StringLike: {
          'token.actions.githubusercontent.com:sub': 'repo:timmyers/fearless:*',
        },
        'ForAllValues:StringEquals': {
          'token.actions.githubusercontent.com:iss': 'https://token.actions.githubusercontent.com',
          'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
        },
      },
    }],
  },
  tags: defaultTags,
});

new aws.iam.RolePolicy('github', {
  role: githubRole.name,
  name: 'github',
  policy: {
    Version: '2012-10-17',
    Statement: [{
      Effect: 'Allow',
      Action: 'sts:AssumeRole',
      Resource: infrastructureRole.arn,
    }],
  },
});