Creating an AWS IAM Role with GitHub as a Web Identity Provider

To enable your GitHub Actions workflows to securely interact with AWS services, you can set up OIDC (OpenID Connect) authentication. By configuring GitHub as a Web Identity Provider, you can create an IAM role that GitHub Actions can assume without needing AWS credentials. Here’s how you can set this up.

Go to the AWS IAM Console.
Make sure you have the necessary permissions to manage IAM resources.

Step 2: Navigate to Identity Providers

In the left sidebar, click on Identity providers under Access management.

Step 3: Add a New Identity Provider

Click on the Add provider button.
Select OpenID Connect for the provider type.
Web Identity Provider URL: Enter https://token.actions.githubusercontent.com.
Audience: Enter sts.amazonaws.com.

Step 4: Create an IAM Role for GitHub Actions

After configuring the identity provider, create a new IAM Role.
Go to the Roles section and click Create role.
Select Web Identity as the trusted entity type.
Under Identity provider, select the GitHub identity provider you just created.
For Audience, enter sts.amazonaws.com.
You can mention the Github Org name and repository name for fine gain access control.

Step 4: Define the Trust Relationship for the Role

GitHub Actions workflows will assume this role using the trust policy. Here’s an example of the trust policy you can use:

Here’s an example trust policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Principal": {
                "Federated": "arn:aws:iam::<account-id>:oidc-provider/token.actions.githubusercontent.com"
            },
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": [
                        "sts.amazonaws.com"
                    ]
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": [
                        "repo:<owner>/<repo>"
                    ]
                }
            }
        }
    ]
}

Replace <account-id> with your AWS account ID.
Replace <owner> and <repo> with your GitHub repository’s owner and name.

Step 5: Attach Permissions to the IAM Role

Add the necessary permissions for the role. These permissions define what resources the GitHub Actions workflow can access (e.g., deploy code, interact with AWS services).

Step 6: Review and Create the Role

Review your settings, and click Create role. The IAM role is now ready to be used by your GitHub Actions workflows.

Step 7: Configure GitHub Actions Workflow

In your GitHub Actions workflow file (.github/workflows/your-workflow.yml), add a step to configure AWS credentials using the role you’ve created.

Here’s an example of the step to configure AWS credentials:

- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::<account-id>:role/<role-name>
    role-duration-seconds: 3600
    aws-region: <aws-region>

Conclusion

Now your GitHub Actions workflow can securely interact with AWS services using OIDC authentication, eliminating the need for static access keys. By following these steps, you’ll enhance security and streamline the process of automating deployments and other tasks.

Happy provisioning!