-
Notifications
You must be signed in to change notification settings - Fork 37
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #50 from aws-samples/github-oidc
added CDK code to create roles used by github actions.
- Loading branch information
Showing
7 changed files
with
262 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| { | ||
| "app": "dotnet run --project cdk/cdk.csproj", | ||
| "watch": { | ||
| "include": [ | ||
| "**" | ||
| ], | ||
| "exclude": [ | ||
| "README.md", | ||
| "cdk*.json", | ||
| "src/*/obj", | ||
| "src/*/bin", | ||
| "src/*.sln", | ||
| "src/*/GlobalSuppressions.cs", | ||
| "src/*/*.csproj" | ||
| ] | ||
| }, | ||
| "context": { | ||
| "@aws-cdk/aws-lambda:recognizeLayerVersion": true, | ||
| "@aws-cdk/core:checkSecretUsage": true, | ||
| "@aws-cdk/core:target-partitions": [ | ||
| "aws", | ||
| "aws-cn" | ||
| ], | ||
| "@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true, | ||
| "@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true, | ||
| "@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true, | ||
| "@aws-cdk/aws-iam:minimizePolicies": true, | ||
| "@aws-cdk/core:validateSnapshotRemovalPolicy": true, | ||
| "@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true, | ||
| "@aws-cdk/aws-s3:createDefaultLoggingPolicy": true, | ||
| "@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true, | ||
| "@aws-cdk/aws-apigateway:disableCloudWatchRole": true, | ||
| "@aws-cdk/core:enablePartitionLiterals": true, | ||
| "@aws-cdk/aws-events:eventsTargetQueueSameAccount": true, | ||
| "@aws-cdk/aws-iam:standardizedServicePrincipals": true, | ||
| "@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true, | ||
| "@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true, | ||
| "@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true, | ||
| "@aws-cdk/aws-route53-patters:useCertificate": true, | ||
| "@aws-cdk/customresources:installLatestAwsSdkDefault": false, | ||
| "@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true, | ||
| "@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true, | ||
| "@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true, | ||
| "@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true, | ||
| "@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true, | ||
| "@aws-cdk/aws-redshift:columnId": true, | ||
| "@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true, | ||
| "@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true, | ||
| "@aws-cdk/aws-apigateway:requestValidatorUniqueId": true, | ||
| "@aws-cdk/aws-kms:aliasNameRef": true, | ||
| "@aws-cdk/core:includePrefixInUniqueNameGeneration": true | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| using System.Collections.Generic; | ||
| using Amazon.CDK; | ||
| using Amazon.CDK.AWS.IAM; | ||
| using Constructs; | ||
|
|
||
| namespace AWS.DotnetServerlessDemo.Cdk; | ||
|
|
||
| public class GithubOIDCConnectionStack : Stack | ||
| { | ||
| private const string DotnetServerlessRepoName = "aws-samples/serverless-dotnet-demo"; | ||
|
|
||
| internal GithubOIDCConnectionStack(Construct scope, string id, IStackProps props = null) | ||
| : base(scope, id, props) | ||
| { | ||
| var githubIdentity = CreateGitHubOidcTestRunner(); | ||
|
|
||
| AddSamDeploymentRole(githubIdentity); | ||
| AddLoadTestRunnerRole(githubIdentity); | ||
| } | ||
|
|
||
| /// <remarks> | ||
| /// GitHub Documentation: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services | ||
| /// Example Blog: https://towardsthecloud.com/aws-cdk-openid-connect-github | ||
| /// </remarks> | ||
| private WebIdentityPrincipal CreateGitHubOidcTestRunner() | ||
| { | ||
| var githubProvider = | ||
| new OpenIdConnectProvider( | ||
| this, | ||
| "githubProvider", | ||
| new OpenIdConnectProviderProps | ||
| { | ||
| Url = "https://token.actions.githubusercontent.com", | ||
| ClientIds = new[] {"sts.amazonaws.com"} | ||
| } | ||
| ); | ||
|
|
||
| var assumeRoleIdentity = new WebIdentityPrincipal( | ||
| githubProvider.OpenIdConnectProviderArn, | ||
| conditions: new Dictionary<string, object> | ||
| { | ||
| { | ||
| "StringLike", | ||
| new Dictionary<string, string> | ||
| { | ||
| { "token.actions.githubusercontent.com:sub", $"repo:{DotnetServerlessRepoName}:*" }, | ||
| { "token.actions.githubusercontent.com:aud", "sts.amazonaws.com" } | ||
| } | ||
| } | ||
| } | ||
| ); | ||
|
|
||
| return assumeRoleIdentity; | ||
| } | ||
|
|
||
| /// <summary> | ||
| /// Create a role that <paramref name="githubIdentity"/> can use to | ||
| /// invoke `sam deploy` commands from GitHub Actions. | ||
| /// </summary> | ||
| private void AddSamDeploymentRole(WebIdentityPrincipal githubIdentity) | ||
| { | ||
| var githubSamDeploymentRole = new Role( | ||
| this, | ||
| "githubSamDeploymentRole", | ||
| new RoleProps | ||
| { | ||
| AssumedBy = githubIdentity, | ||
| ManagedPolicies = new[] | ||
| { | ||
| ManagedPolicy.FromAwsManagedPolicyName("AdministratorAccess"), | ||
| ManagedPolicy.FromAwsManagedPolicyName("CloudWatchAgentServerPolicy") | ||
| }, | ||
| RoleName = "githubSamDeploymentRole", | ||
| MaxSessionDuration = Duration.Hours(1) | ||
| } | ||
| ); | ||
|
|
||
| new CfnOutput( | ||
| this, | ||
| "githubSamDeploymentRoleArn", | ||
| new CfnOutputProps | ||
| { | ||
| Value = githubSamDeploymentRole.RoleArn, | ||
| ExportName = "githubSamDeploymentRoleArn" | ||
| } | ||
| ); | ||
| } | ||
|
|
||
| /// <summary> | ||
| /// Create a role that <paramref name="githubIdentity"/> can use to | ||
| /// invoke Load Test commands from GitHub Actions. | ||
| /// </summary> | ||
| private void AddLoadTestRunnerRole(WebIdentityPrincipal githubIdentity) | ||
| { | ||
| var githubLoadTestRunnerRole = new Role( | ||
| this, | ||
| "githubLoadTestRunnerRole", | ||
| new RoleProps | ||
| { | ||
| AssumedBy = githubIdentity, | ||
| ManagedPolicies = new[] | ||
| { | ||
| ManagedPolicy.FromAwsManagedPolicyName("AdministratorAccess"), | ||
| ManagedPolicy.FromAwsManagedPolicyName("CloudWatchAgentServerPolicy") | ||
| }, | ||
| RoleName = "githubLoadTestRunnerRole", | ||
| MaxSessionDuration = Duration.Hours(1) | ||
| } | ||
| ); | ||
|
|
||
| new CfnOutput( | ||
| this, | ||
| "githubLoadTestRunnerRoleArn", | ||
| new CfnOutputProps | ||
| { | ||
| Value = githubLoadTestRunnerRole.RoleArn, | ||
| ExportName = "githubLoadTestRunnerRoleArn" | ||
| } | ||
| ); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| [assembly: System.Diagnostics.CodeAnalysis.SuppressMessage( | ||
| "Potential Code Quality Issues", | ||
| "RECS0026:Possible unassigned object created by 'new'", | ||
| Justification = "Constructs add themselves to the scope in which they are created" | ||
| )] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| using Amazon.CDK; | ||
|
|
||
| namespace AWS.DotnetServerlessDemo.Cdk; | ||
|
|
||
| sealed class Program | ||
| { | ||
| public static void Main(string[] args) | ||
| { | ||
| var app = new App(); | ||
|
|
||
| new GithubOIDCConnectionStack( | ||
| app, | ||
| "GithubOIDCConnectionStack", | ||
| new StackProps | ||
| { | ||
| TerminationProtection = true | ||
| } | ||
| ); | ||
|
|
||
| app.Synth(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| <Project Sdk="Microsoft.NET.Sdk"> | ||
|
|
||
| <PropertyGroup> | ||
| <OutputType>Exe</OutputType> | ||
| <TargetFramework>net8.0</TargetFramework> | ||
| <!-- Roll forward to future major versions of the netcoreapp as needed --> | ||
| <RollForward>Major</RollForward> | ||
| <RootNamespace>AWS.DotnetServerlessDemo.Cdk</RootNamespace> | ||
| </PropertyGroup> | ||
|
|
||
| <ItemGroup> | ||
| <!-- CDK Construct Library dependencies --> | ||
| <PackageReference Include="Amazon.CDK.Lib" Version="2.84.0" /> | ||
| <PackageReference Include="Constructs" Version="[10.0.0,11.0.0)" /> | ||
|
|
||
| <!-- jsii Roslyn analyzers (un-comment to obtain compile-time checks for missing required props--> | ||
| <PackageReference Include="Amazon.Jsii.Analyzers" Version="*" PrivateAssets="all" /> | ||
|
|
||
| </ItemGroup> | ||
| </Project> |