An identity provider (IdP) lets a platform such as GitHub Actions or Spacelift prove its identity to a vendor or cloud account. Registering the provider establishes authentication; it does not yet grant permissions. section 8.5.1
OpenID Connect uses a provider URL and identity token to identify a user or machine. Authorization follows separately: AWS maps the identity to an assumable IAM role, while Azure maps it to a service principal. section 8.5.1
Listing 8.13 Registering an OIDC provider with AWS
locals {
gh_actions_token_url = "https://token.actions.githubusercontent.com" #1
}
data "tls_certificate" "gh_actions" {
url = local.gh_actions_token_url #2
}
resource "aws_iam_openid_connect_provider" "github" { #3
url = local.gh_actions_token_url #4
thumbprint_list = data.tls_certificate.gh_actions.certificates[*].
sha1_fingerprint #5
client_id_list = ["sts.amazonaws.com"] #6
}
#1 This is the URL for the GitHub Actions OIDC token service.
#2 OIDC uses the TLS certificate to verify the identity of the service.
#3 This resource should only be called once per account per url.
#4 These values comes from the GitHub Actions documentation.
#5 This is the SHA1 fingerprint of the certificates attached to the GitHub OIDC service.
#6 For AWS, you will almost always use the security token service as the client.
Register a GitHub Actions OIDC provider in AWS with Terraform, deriving the certificate fingerprint and configuring the STS client ID. Create this provider once per account and URL. section 8.5.1
Restricting workflow access
A GitHub Actions workflow requests an OIDC token, then uses an AWS credentials action to assume a repository-specific role. The role trust relationship should restrict which repository and workflows may use it. section 8.5.1
