feat: add oidc modules (#7)

Author: Script47

oidc-github-actions-iam-role/README.md

@@ -0,0 +1,13 @@
+# OIDC GitHub IAM Role
+
+## About
+
+This module allows you to setup an IAM role for GitHub OIDC:
+
+- IAM role with trust policy
+
+## Assumptions
+
+## Usage
+
+See `variables.tf` for the full argument reference.

oidc-github-actions-iam-role/data.tf

@@ -0,0 +1,29 @@
+data "aws_iam_openid_connect_provider" "github" {
+  url      = "https://token.actions.githubusercontent.com"
+  provider = aws.default
+}
+
+data "aws_iam_policy_document" "assume_role_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+
+    principals {
+      type = "Federated"
+      identifiers = [data.aws_iam_openid_connect_provider.github.arn]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "token.actions.githubusercontent.com:aud"
+      values = ["sts.amazonaws.com"]
+    }
+
+    condition {
+      test     = "StringLike"
+      variable = "token.actions.githubusercontent.com:sub"
+      values = ["repo:${var.repo}"]
+    }
+  }
+}

oidc-github-actions-iam-role/iam.tf

@@ -0,0 +1,13 @@
+resource "aws_iam_role" "role" {
+  name               = var.role_name
+  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
+  tags               = var.tags
+  provider           = aws.default
+}
+
+resource "aws_iam_role_policy" "policy" {
+  name     = var.policy_name
+  role     = aws_iam_role.role.id
+  policy   = var.policy
+  provider = aws.default
+}

oidc-github-actions-iam-role/outputs.tf

@@ -0,0 +1,14 @@
+output "role" {
+  value = {
+    id   = aws_iam_role.role.id
+    arn  = aws_iam_role.role.arn
+    name = aws_iam_role.role.name
+  }
+}
+
+output "policy" {
+  value = {
+    id  = aws_iam_role_policy.policy.id
+    arn = aws_iam_role_policy.policy.name
+  }
+}

oidc-github-actions-iam-role/providers.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+      configuration_aliases = [
+        aws.default,
+      ]
+    }
+  }
+}

oidc-github-actions-iam-role/variables.tf

@@ -0,0 +1,27 @@
+variable "role_name" {
+  type        = string
+  description = "The IAM role name"
+  default     = null
+}
+
+variable "policy_name" {
+  type        = string
+  description = "The IAM role policy name"
+  default     = null
+}
+
+variable "policy" {
+  type        = string
+  description = "The IAM role policy in JSON format"
+}
+
+variable "repo" {
+  type        = string
+  description = "The GitHub repository path (e.g. org/repo:ref:refs/heads/master)"
+}
+
+variable "tags" {
+  type = map(string)
+  description = "The tags to apply to all resources created"
+  default = {}
+}

oidc-github-actions-provider/oidc.tf

@@ -0,0 +1,7 @@
+resource "aws_iam_openid_connect_provider" "github" {
+  url             = "https://token.actions.githubusercontent.com"
+  client_id_list  = ["sts.amazonaws.com"]
+  thumbprint_list = var.thumbprints
+  tags            = var.tags
+  provider        = aws.default
+}

oidc-github-actions-provider/providers.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+      configuration_aliases = [
+        aws.default,
+      ]
+    }
+  }
+}

oidc-github-actions-provider/variables.tf

@@ -0,0 +1,11 @@
+variable "thumbprints" {
+  type        = list(string)
+  description = "An optional thumbprint list."
+  default     = []
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "The tags to apply to all resources created"
+  default     = {}
+}

static-site/README.md

@@ -1,4 +1,4 @@
-# Static Site Module
+# Static Site
 
 ## About
 
@@ -9,15 +9,9 @@ This module allows you to setup a static site with the following features:
   - Automatic DNS validation for ACM via Route 53
   - Optional creation of Route 53 Hosted Zone (or reuse an existing one)
   - Multi-domain support
-- CI/CD deploy IAM role via OIDC (optional)
 - Fallback support for SPA (`403 → 200 /index.html` and `404 → 200 /index.html`)
 - Resource tagging for manageable resources
 
-## Assumptions
-
-This module assumes you have GitHub OIDC setup to use the CD features provided by the module. You can use the `setup_cd`
-toggle to disable this.
-
 ## Usage
 
 See `variables.tf` for the full argument reference.
@@ -29,9 +23,6 @@ module "static_site" {
   domains     = ["example.org"]
   bucket_name = "example.org"
   hosted_zone = "my-hosted_zone"
-  role_name   = "deploy-example-org"
-  repo        = "example-org/repo:ref:refs/heads/master"
-  setup_cd    = false
 
   restriction = {
     type      = "none"