adam/.github
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/.github.git synced 2026-09-30 10:33:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add OIDC deploy role for front-integrations (#22)

Browse source 
Consolidates front-sla-monitor and google-user-sync into a single
SAM deploy role for the new front-integrations repo.
This commit is contained in:
Adam Moussa 2026-05-12 13:37:04 -04:00 • committed by GitHub
parent 2cab51d032
commit bcbfd8ebfa
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 73 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

74
oidc-deploy-roles.yaml
View file

@ -72,7 +72,7 @@ Resources:
Resource: "*" Resource: "*"
# --------------------------------------------------------------------------- # ---------------------------------------------------------------------------
# SAM deploy roles (5 repos) # SAM deploy roles (6 repos)
# --------------------------------------------------------------------------- # ---------------------------------------------------------------------------
AfterhoursShiftManagerDeployRole: AfterhoursShiftManagerDeployRole:
@ -145,6 +145,76 @@ Resources:
Resource: Resource:
- !GetAtt SamCfnExecutionRole.Arn - !GetAtt SamCfnExecutionRole.Arn
FrontIntegrationsDeployRole:
Type: AWS::IAM::Role
Properties:
RoleName: githubdeploy-front-integrations
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com
Action: sts:AssumeRoleWithWebIdentity
Condition:
StringEquals:
token.actions.githubusercontent.com:aud: sts.amazonaws.com
StringLike:
token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/front-integrations:ref:refs/heads/main
Policies:
- PolicyName: sam-deploy
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- cloudformation:CreateChangeSet
- cloudformation:DeleteChangeSet
- cloudformation:DescribeChangeSet
- cloudformation:DescribeStackEvents
- cloudformation:DescribeStacks
- cloudformation:ExecuteChangeSet
- cloudformation:GetTemplate
- cloudformation:ListStackResources
- cloudformation:UpdateStack
- cloudformation:CreateStack
- cloudformation:TagResource
Resource:
- !Sub arn:aws:cloudformation:us-east-1:${AWS::AccountId}:stack/front-integrations/*
- Effect: Allow
Action:
- cloudformation:GetTemplateSummary
Resource: "*"
- Effect: Allow
Action:
- cloudformation:DescribeStacks
- cloudformation:CreateChangeSet
- cloudformation:DescribeChangeSet
- cloudformation:ExecuteChangeSet
- cloudformation:CreateStack
Resource:
- !Sub arn:aws:cloudformation:us-east-1:${AWS::AccountId}:stack/aws-sam-cli-managed-default/*
- Effect: Allow
Action:
- s3:PutObject
- s3:GetObject
- s3:ListBucket
- s3:GetBucketLocation
- s3:CreateBucket
- s3:PutBucketPolicy
- s3:GetBucketPolicy
- s3:PutLifecycleConfiguration
- s3:PutBucketVersioning
- s3:DeleteObject
Resource:
- arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-*
- arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-*/*
- Effect: Allow
Action:
- iam:PassRole
Resource:
- !GetAtt SamCfnExecutionRole.Arn
ExpenseApprovalBotDeployRole: ExpenseApprovalBotDeployRole:
Type: AWS::IAM::Role Type: AWS::IAM::Role
Properties: Properties:
@ -571,6 +641,8 @@ Outputs:
Name: github-cfn-execution-role-arn Name: github-cfn-execution-role-arn
AfterhoursShiftManagerDeployRoleArn: AfterhoursShiftManagerDeployRoleArn:
Value: !GetAtt AfterhoursShiftManagerDeployRole.Arn Value: !GetAtt AfterhoursShiftManagerDeployRole.Arn
FrontIntegrationsDeployRoleArn:
Value: !GetAtt FrontIntegrationsDeployRole.Arn
ExpenseApprovalBotDeployRoleArn: ExpenseApprovalBotDeployRoleArn:
Value: !GetAtt ExpenseApprovalBotDeployRole.Arn Value: !GetAtt ExpenseApprovalBotDeployRole.Arn
AfiBackupMonitorDeployRoleArn: AfiBackupMonitorDeployRoleArn: