@guardian/cdk 50.8.0 → 50.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"github-actions.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/github-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"github-actions.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/github-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAgBjC,MAAM,WAAW,kCAAkC;IACjD;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAYD,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,kCAAkC,CAAC;CAChD;AAyBD;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,MAAM;gBACjC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB;CAmB5D"}
|
|
@@ -7,9 +7,15 @@ const roles_1 = require("./roles");
|
|
|
7
7
|
const GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN = "token.actions.githubusercontent.com";
|
|
8
8
|
/*
|
|
9
9
|
Thumbprint of `GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN`.
|
|
10
|
-
|
|
10
|
+
|
|
11
|
+
See:
|
|
12
|
+
- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
|
|
13
|
+
- https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/
|
|
11
14
|
*/
|
|
12
|
-
const
|
|
15
|
+
const GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN_THUMBPRINTS = [
|
|
16
|
+
"6938fd4d98bab03faadb97b34396831e3780aea1",
|
|
17
|
+
"1c58a3a8518e8759bf075b76b750d4f2df264fcd",
|
|
18
|
+
];
|
|
13
19
|
const GuGithubActionsRepositoryCondition = {
|
|
14
20
|
toString: ({ githubOrganisation, repositories }) => `repo:${githubOrganisation}/${repositories ?? "*"}`,
|
|
15
21
|
};
|
|
@@ -34,7 +40,7 @@ class GitHubOidcProvider extends aws_cdk_lib_1.CfnResource {
|
|
|
34
40
|
properties: {
|
|
35
41
|
Url: `https://${GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN}`,
|
|
36
42
|
ClientIdList: ["sts.amazonaws.com"],
|
|
37
|
-
ThumbprintList:
|
|
43
|
+
ThumbprintList: GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN_THUMBPRINTS,
|
|
38
44
|
},
|
|
39
45
|
});
|
|
40
46
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"github-actions.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/github-actions.ts"],"names":[],"mappings":";;;AAAA,6CAAqD;AACrD,iDAAyD;AAGzD,mCAAiC;AAEjC,MAAM,sCAAsC,GAAG,qCAAqC,CAAC;AAErF
|
|
1
|
+
{"version":3,"file":"github-actions.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/github-actions.ts"],"names":[],"mappings":";;;AAAA,6CAAqD;AACrD,iDAAyD;AAGzD,mCAAiC;AAEjC,MAAM,sCAAsC,GAAG,qCAAqC,CAAC;AAErF;;;;;;EAME;AACF,MAAM,kDAAkD,GAAG;IACzD,0CAA0C;IAC1C,0CAA0C;CAC3C,CAAC;AAcF,MAAM,kCAAkC,GAAG;IACzC,QAAQ,EAAE,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAsC,EAAU,EAAE,CAC7F,QAAQ,kBAAkB,IAAI,YAAY,IAAI,GAAG,EAAE;CACtD,CAAC;AAEF,MAAM,yBAAyB,GAAuC;IACpE,kBAAkB,EAAE,UAAU;IAC9B,YAAY,EAAE,GAAG;CAClB,CAAC;AAeF;;;;;;;;;GASG;AACH,MAAM,kBAAmB,SAAQ,yBAAW;IAC1C,YAAY,KAAc;QACxB,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE;YAChC,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE;gBACV,GAAG,EAAE,WAAW,sCAAsC,EAAE;gBACxD,YAAY,EAAE,CAAC,mBAAmB,CAAC;gBACnC,cAAc,EAAE,kDAAkD;aACnE;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAa,mBAAoB,SAAQ,cAAM;IAC7C,YAAY,KAAc,EAAE,KAA+B;QACzD,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE;YAChC,SAAS,EAAE,IAAI,4BAAkB,CAC/B,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,EACjC;gBACE,UAAU,EAAE;oBACV,CAAC,GAAG,sCAAsC,MAAM,CAAC,EAAE,kCAAkC,CAAC,QAAQ,CAC5F,KAAK,CAAC,SAAS,IAAI,yBAAyB,CAC7C;iBACF;aACF,EACD,+BAA+B,CAChC;SACF,CAAC,CAAC;QAEH,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpD,IAAI,uBAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;CACF;AApBD,kDAoBC","sourcesContent":["import { CfnOutput, CfnResource } from \"aws-cdk-lib\";\nimport { FederatedPrincipal } from \"aws-cdk-lib/aws-iam\";\nimport type { GuStack } from \"../../core\";\nimport type { GuPolicy } from \"../policies\";\nimport { GuRole } from \"./roles\";\n\nconst GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN = \"token.actions.githubusercontent.com\";\n\n/*\nThumbprint of `GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN`.\n\nSee:\n - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html\n - https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/\n*/\nconst GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN_THUMBPRINTS = [\n \"6938fd4d98bab03faadb97b34396831e3780aea1\",\n \"1c58a3a8518e8759bf075b76b750d4f2df264fcd\",\n];\n\nexport interface GuGithubActionsRepositoryCondition {\n /**\n * The GitHub organisation/user to constrain the IAM Role to.\n */\n githubOrganisation: string;\n\n /**\n * Repositories to constrain the IAM Role to.\n */\n repositories?: string;\n}\n\nconst GuGithubActionsRepositoryCondition = {\n toString: ({ githubOrganisation, repositories }: GuGithubActionsRepositoryCondition): string =>\n `repo:${githubOrganisation}/${repositories ?? \"*\"}`,\n};\n\nconst ALL_GUARDIAN_REPOSITORIES: GuGithubActionsRepositoryCondition = {\n githubOrganisation: \"guardian\",\n repositories: \"*\",\n};\n\nexport interface GuGithubActionsRoleProps {\n /**\n * A list of IAM Policies for the GitHub Action.\n */\n policies: GuPolicy[];\n\n /**\n * Repositories where GitHub Actions can assumes this role.\n * Defaults to [[`ALL_GUARDIAN_REPOSITORIES`]].\n */\n condition?: GuGithubActionsRepositoryCondition;\n}\n\n/*\nAWS CDK implements an OIDCProvider as a custom resource.\nThis requires a lambda to be deployed into the account.\nAs far as I can tell, the lambda is automating the setting of `ThumbprintList`, which is quite generic.\nIt's simpler for us to be specific here.\n\nSee:\n - https://github.com/aws/aws-cdk/blob/851c8ca9989856fa61496ff113f9cb8c66d02f3b/packages/%40aws-cdk/aws-iam/lib/oidc-provider.ts\n - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html\n */\nclass GitHubOidcProvider extends CfnResource {\n constructor(scope: GuStack) {\n super(scope, \"GithubActionsOidc\", {\n type: \"AWS::IAM::OIDCProvider\",\n properties: {\n Url: `https://${GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN}`,\n ClientIdList: [\"sts.amazonaws.com\"],\n ThumbprintList: GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN_THUMBPRINTS,\n },\n });\n }\n}\n\n/**\n * A construct to create an IAM role for GitHub Actions to assume via `AssumeRoleWithWebIdentity`.\n *\n * An Output will be added to the stack with the Role's ARN for use with https://github.com/aws-actions/configure-aws-credentials.\n *\n * See:\n * - https://github.com/aws-actions/configure-aws-credentials\n * - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html\n */\nexport class GuGithubActionsRole extends GuRole {\n constructor(scope: GuStack, props: GuGithubActionsRoleProps) {\n super(scope, \"GithubActionsRole\", {\n assumedBy: new FederatedPrincipal(\n new GitHubOidcProvider(scope).ref,\n {\n StringLike: {\n [`${GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN}:sub`]: GuGithubActionsRepositoryCondition.toString(\n props.condition ?? ALL_GUARDIAN_REPOSITORIES\n ),\n },\n },\n \"sts:AssumeRoleWithWebIdentity\"\n ),\n });\n\n props.policies.forEach((p) => p.attachToRole(this));\n\n new CfnOutput(this, `${this.node.id}-Arn`, { value: this.roleArn });\n }\n}\n"]}
|