mb-public-code/github-oidc.yaml at main · razroo/mb-public-code · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: 'Makebind - GitHub Actions OIDC Integration for AWS (Organization-Wide Setup)'

Parameters:
  GitHubOrg:
    Type: String
    Description: GitHub organization or username (e.g., razroo)

  RazrooOrgId:
    Type: String
    Description: Razroo organization ID (e.g., razroo-org-123)

  RepositoryName:
    Type: String
    Description: Repository name pattern - use '*' for all repos in the org (recommended), or specify a single repo name
    Default: '*'

  CallbackUrl:
    Type: String
    Description: Razroo API endpoint for automatic GitHub configuration (leave default for production)
    Default: 'https://w7tbk6sceb.execute-api.us-east-1.amazonaws.com/prod/githubOidcCallback'

Resources:
  GitHubOIDCProvider:
    Type: AWS::IAM::OIDCProvider
    Properties:
      Url: https://token.actions.githubusercontent.com
      ClientIdList:
        - sts.amazonaws.com
      ThumbprintList:
        - 6938fd4d98bab03faadb97b34396831e3780aea1
        - 1c58a3a8518e8759bf075b76b750d4f2df264fcd

  GitHubActionsRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: MakebindGitHubActionsRole
      Description: Role used by GitHub Actions to deploy infrastructure via Makebind
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Federated: !GetAtt GitHubOIDCProvider.Arn
            Action: sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                token.actions.githubusercontent.com:aud: sts.amazonaws.com
              StringLike:
                token.actions.githubusercontent.com:sub: !Sub 'repo:${GitHubOrg}/${RepositoryName}:*'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
      MaxSessionDuration: 3600

  GitHubOIDCCustomResourceFunction:
    Type: AWS::Serverless::Function
    Metadata:
      BuildMethod: makefile
      aws:asset:region: us-east-1
    Properties:
      Handler: index.handler
      Runtime: nodejs22.x
      CodeUri: lambda/github-oidc-custom-resource
      Description: Custom resource handler for GitHub OIDC setup
      Timeout: 60
      FunctionName: !Sub ${AWS::StackName}-GitHubOIDCCustomResourceFunction
      Environment:
        Variables:
          AWS_REGION_OVERRIDE: us-east-1
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource: '*'

  CustomResourceInvocation:
    Type: Custom::OIDCSetup
    Properties:
      ServiceToken: !GetAtt GitHubOIDCCustomResourceFunction.Arn
      GitHubOrg: !Ref GitHubOrg
      RazrooOrgId: !Ref RazrooOrgId
      RepositoryName: !Ref RepositoryName
      OIDCProviderArn: !GetAtt GitHubOIDCProvider.Arn
      RoleArn: !GetAtt GitHubActionsRole.Arn
      CallbackUrl: !Ref CallbackUrl

Outputs:
  RoleArn:
    Description: 'ARN of the IAM Role for GitHub Actions. If automatic configuration succeeded, this has been saved to your GitHub organization. Otherwise, paste this in Makebind chat to complete setup.'
    Value: !GetAtt GitHubActionsRole.Arn
    Export:
      Name: MakebindGitHubActionsRoleArn

  OIDCProviderArn:
    Description: ARN of the OIDC Provider for GitHub Actions
    Value: !GetAtt GitHubOIDCProvider.Arn

  TrustedRepos:
    Description: GitHub repositories that can assume this role
    Value: !Sub '${GitHubOrg}/${RepositoryName}'