This component is responsible for authorizing the GitHub OIDC provider
as an Identity provider for an AWS account. It is meant to be used
in concert with
aws-team-roles and/or with
Stack Level: Global
Here's an example snippet for how to use this component.
- This must be installed in the
identityaccount in order to use standard SAML roles with role chaining.
- This must be installed in each individual account where you want to provision a service role for a GitHub action that will be assumed directly by the action.
For security, since this component adds an identity provider, only SuperAdmin can install it.
Configuring the Github OIDC Provider
This component was created to add the Github OIDC provider so that Github Actions can safely assume roles
without the need to store static credentials in the environment.
The details of the GitHub OIDC provider are hard coded in the component, however at some point
the provider's thumbprint may change, at which point you can use
to get the new thumbprint and add it to the list in
This script will pull one of two thumbprints. There are two possible intermediary certificates for the Actions SSL
certificate and either can be returned by the GitHub servers, requiring customers to trust both. This is a known
behavior when the intermediary certificates are cross-signed by the CA. Therefore, run this script until both values
are retrieved. Add both to
I cannot assume the role from GitHub Actions after deploying
The following error is very common if the GitHub workflow is missing proper permission.
Error: User: arn:aws:sts::***:assumed-role/acme-core-use1-auto-actions-runner@actions-runner-system/token-file-web-identity is not authorized to perform: sts:TagSession on resource: arn:aws:iam::999999999999:role/acme-plat-use1-dev-gha
In order to use a web identity, GitHub Action pipelines must have the following permission. See GitHub Action documentation for more.
id-token: write # This is required for requesting the JWT
contents: read # This is required for actions/checkout
|additional_tag_map||Additional key-value pairs to add to each map in |
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration.
|attributes||ID element. Additional attributes (e.g. |
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the
and treated as a single ID element.
|context||Single object for setting entire context at once.|
See description of individual variables for details.
Leave string and numeric variables as
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.
|delimiter||Delimiter to be used between ID elements.|
|descriptor_formats||Describe additional descriptors to be output in the |
Map of maps. Keys are names of descriptors. Values are maps of the form
Label values will be normalized before being passed to
identical to how they appear in
|enabled||Set to false to prevent the module from creating any resources||no|
|environment||ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'||no|
Does not affect
|label_key_case||Controls the letter case of the |
Does not affect keys of tags passed in via the
|label_order||The order in which the labels (ID elements) appear in the |
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
|label_value_case||Controls the letter case of ID elements (labels) as included in |
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the
Set this to
|labels_as_tags||Set of labels (ID elements) to include as tags in the |
Default is to include all labels.
Tags with empty values will not be included in the
The value of the
changed in later chained modules. Attempts to change it will be silently ignored.
|name||ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.|
This is the only ID element not also included as a
The "name" tag is set to the full
|namespace||ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique||no|
|regex_replace_chars||Terraform regular expression (regex) string.|
Characters matching the regex will be removed from the ID elements.
If not set,
|stage||ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'||no|
|tags||Additional tags (e.g. |
Neither the tag keys nor the tag values will be modified by this module.
|tenant||ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for||no|
|thumbprint_list||List of OIDC provider certificate thumbprints||no|
|oidc_provider_arn||GitHub OIDC provider ARN|
- cloudposse/terraform-aws-components - Cloud Posse's upstream component