aws-cdk-github-oidc 2.3.3 → 2.3.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/.jsii +5 -26
  2. package/.nvmrc +1 -1
  3. package/API.md +0 -6
  4. package/README.md +40 -32
  5. package/lib/provider.d.ts +0 -1
  6. package/lib/provider.js +2 -7
  7. package/lib/role.js +1 -1
  8. package/package.json +3 -3
package/.jsii CHANGED
@@ -3514,7 +3514,7 @@
3514
3514
  },
3515
3515
  "name": "aws-cdk-github-oidc",
3516
3516
  "readme": {
3517
- "markdown": "# AWS CDK Github OpenID Connect\n\n![cdk-support](https://img.shields.io/badge/cdk-%20typescript%20|%20python%20-informational \"TypeScript | Python\")\n[![release](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml/badge.svg)](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml)\n[![codecov](https://codecov.io/gh/aripalo/aws-cdk-github-oidc/branch/main/graph/badge.svg?token=5X44RM6J17)](https://codecov.io/gh/aripalo/aws-cdk-github-oidc)\n\n---\n\nAWS [CDK](https://aws.amazon.com/cdk/) constructs that define:\n- Github Actions as OpenID Connect Identity Provider into AWS IAM\n- IAM Roles that can be assumed by Github Actions workflows\n\nThese constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.\n\n## Background information\n\n![github-aws-oidc](/assets/github-aws-oidc.svg \"Github OIDC with AWS\")\n\n- [GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) on Github Changelog Blog.\n- [Security hardening your deployments](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments) on Github Docs.\n- [Assuming a role with `aws-actions/configure-aws-credentials`](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n- Shout-out to [Richard H. Boyd](https://twitter.com/rchrdbyd) for helping me to debug Github OIDC setup with AWS IAM and his [Deploying to AWS with Github Actions](https://www.githubuniverse.com/2021/session/692586/deploying-to-aws-with-github-actions)-talk.\n- Shout-out to [Aidan W Steele](https://twitter.com/__steele) and his blog post [AWS federation comes to GitHub Actions](https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html) for being the original inspiration for this.\n\n\n<br/>\n\n## Getting started\n\n```shell\nnpm i -D aws-cdk-github-oidc\n```\n\n<br/>\n\n### OpenID Connect Identity Provider trust for AWS IAM\n\nTo create a new Github OIDC provider configuration into AWS IAM:\n```ts\nimport { GithubActionsIdentityProvider } from 'aws-cdk-github-oidc';\n\nconst provider = new GithubActionsIdentityProvider(scope, 'GithubProvider');\n```\n\nIn the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws), audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation) and the thumbprint as Github's `a031c46782e6e6c662c2c87c76da9aa62ccabd8e`\n\n<br/>\n\n### Retrieving a reference to an existing Github OIDC provider configuration\n\nRemember, **there can be only one (Github OIDC provider per AWS Account)**, so to retrieve a reference to existing Github OIDC provider use `fromAccount` static method:\n```ts\nimport { GithubActionsIdentityProvider } from 'aws-cdk-github-oidc';\n\nconst provider = GithubActionsIdentityProvider.fromAccount(scope, 'GithubProvider');\n```\n\n<br/>\n\n### Defining a role for Github Actions workflow to assume\n\n```ts\nimport { GithubActionsRole } from 'aws-cdk-github-oidc';\n\nconst uploadRole = new GithubActionsRole(scope, 'UploadRole', {\n provider: provider, // reference into the OIDC provider\n owner: 'octo-org', // your repository owner (organization or user) name\n repo: 'octo-repo', // your repository name (without the owner name)\n filter: 'ref:refs/tags/v*', // JWT sub suffix filter, defaults to '*'\n});\n\n// use it like any other role, for example grant S3 bucket write access:\nmyBucket.grantWrite(uploadRole);\n```\n\nYou may pass in any `iam.RoleProps` into the construct's props, except `assumedBy` which will be defined by this construct (CDK will fail if you do):\n```ts\nconst deployRole = new GithubActionsRole(scope, 'DeployRole', {\n provider: provider,\n owner: 'octo-org',\n repo: 'octo-repo',\n roleName: 'MyDeployRole',\n description: 'This role deploys stuff to AWS',\n maxSessionDuration: cdk.Duration.hours(2),\n});\n\n// You may also use various \"add*\" policy methods!\n// \"AdministratorAccess\" not really a good idea, just for an example here:\ndeployRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'));\n```\n\n<br/>\n\n#### Subject Filter\n\nBy default the value of `filter` property will be `'*'` which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on the [examples in Github Docs](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#configuring-the-oidc-trust-with-the-cloud); For example:\n\n| `filter` value | Descrition |\n| :----------------------------- | :--------------------------------------- |\n| `'ref:refs/tags/v*'` | Allow only tags with prefix of `v` |\n| `'ref:refs/heads/demo-branch'` | Allow only from branch `demo-branch` |\n| `'pull_request'` | Allow only from pull request |\n| `'environment:Production'` | Allow only from `Production` environment |\n\n<br/>\n\n### Github Actions Workflow\n\nTo actually utilize this in your Github Actions workflow, use [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) to [assume a role](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n\nAt the moment you must use the `master` version (until AWS releases a new tag):\n\n```yaml\njobs:\n deploy:\n name: Upload to Amazon S3\n runs-on: ubuntu-latest\n permissions:\n id-token: write # needed to interact with GitHub's OIDC Token endpoint.\n contents: read\n steps:\n - name: Checkout\n uses: actions/checkout@v2\n\n - name: Configure AWS credentials\n uses: aws-actions/configure-aws-credentials@master\n with:\n role-to-assume: arn:aws:iam::123456789012:role/MyUploadRole\n #role-session-name: MySessionName # Optional\n aws-region: us-east-1\n\n - name: Sync files to S3\n run: |\n aws s3 sync . s3://my-example-bucket\n```\n\n<br/>\n\n### Development Status\n\nThese constructs are fresh out from the oven, since [Github just announced](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) the OpenID Connect feature as generally available. I've been playing around with the feature for some time, but the construct itself haven't yet been widely used.\n\nThese constructs will stay in `v0.x.x` for a while, to allow easier bug fixing & breaking changes _if absolutely needed_. Once bugs are fixed (if any), the constructs will be published with `v1` major version and will be marked as stable.\n\nCurrently only TypeScript, Python and Go versions provided, but before going to stable, I'll probably others (supported by JSII) depending on the amount of work required - so no promises!\n"
3517
+ "markdown": "# AWS CDK Github OpenID Connect\n\n![cdk-support](https://img.shields.io/badge/cdk-%20typescript%20|%20python%20-informational \"TypeScript | Python\")\n[![release](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml/badge.svg)](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml)\n[![codecov](https://codecov.io/gh/aripalo/aws-cdk-github-oidc/branch/main/graph/badge.svg?token=5X44RM6J17)](https://codecov.io/gh/aripalo/aws-cdk-github-oidc)\n\n---\n\nAWS [CDK](https://aws.amazon.com/cdk/) constructs that define:\n\n- Github Actions as OpenID Connect Identity Provider into AWS IAM\n- IAM Roles that can be assumed by Github Actions workflows\n\nThese constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.\n\n## Background information\n\n![github-aws-oidc](/assets/github-aws-oidc.svg \"Github OIDC with AWS\")\n\n- [GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) on Github Changelog Blog.\n- [Security hardening your deployments](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments) on Github Docs.\n- [Assuming a role with `aws-actions/configure-aws-credentials`](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n- Shout-out to [Richard H. Boyd](https://twitter.com/rchrdbyd) for helping me to debug Github OIDC setup with AWS IAM and his [Deploying to AWS with Github Actions](https://www.githubuniverse.com/2021/session/692586/deploying-to-aws-with-github-actions)-talk.\n- Shout-out to [Aidan W Steele](https://twitter.com/__steele) and his blog post [AWS federation comes to GitHub Actions](https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html) for being the original inspiration for this.\n\n<br/>\n\n## Getting started\n\n```shell\nnpm i -D aws-cdk-github-oidc\n```\n\n<br/>\n\n### OpenID Connect Identity Provider trust for AWS IAM\n\nTo create a new Github OIDC provider configuration into AWS IAM:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = new GithubActionsIdentityProvider(scope, \"GithubProvider\");\n```\n\nIn the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) and audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation).\n\n<br/>\n\n### Retrieving a reference to an existing Github OIDC provider configuration\n\nRemember, **there can be only one (Github OIDC provider per AWS Account)**, so to retrieve a reference to existing Github OIDC provider use `fromAccount` static method:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = GithubActionsIdentityProvider.fromAccount(\n scope,\n \"GithubProvider\"\n);\n```\n\n<br/>\n\n### Defining a role for Github Actions workflow to assume\n\n```ts\nimport { GithubActionsRole } from \"aws-cdk-github-oidc\";\n\nconst uploadRole = new GithubActionsRole(scope, \"UploadRole\", {\n provider: provider, // reference into the OIDC provider\n owner: \"octo-org\", // your repository owner (organization or user) name\n repo: \"octo-repo\", // your repository name (without the owner name)\n filter: \"ref:refs/tags/v*\", // JWT sub suffix filter, defaults to '*'\n});\n\n// use it like any other role, for example grant S3 bucket write access:\nmyBucket.grantWrite(uploadRole);\n```\n\nYou may pass in any `iam.RoleProps` into the construct's props, except `assumedBy` which will be defined by this construct (CDK will fail if you do):\n\n```ts\nconst deployRole = new GithubActionsRole(scope, \"DeployRole\", {\n provider: provider,\n owner: \"octo-org\",\n repo: \"octo-repo\",\n roleName: \"MyDeployRole\",\n description: \"This role deploys stuff to AWS\",\n maxSessionDuration: cdk.Duration.hours(2),\n});\n\n// You may also use various \"add*\" policy methods!\n// \"AdministratorAccess\" not really a good idea, just for an example here:\ndeployRole.addManagedPolicy(\n iam.ManagedPolicy.fromAwsManagedPolicyName(\"AdministratorAccess\")\n);\n```\n\n<br/>\n\n#### Subject Filter\n\nBy default the value of `filter` property will be `'*'` which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on the [examples in Github Docs](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#configuring-the-oidc-trust-with-the-cloud); For example:\n\n| `filter` value | Descrition |\n| :----------------------------- | :--------------------------------------- |\n| `'ref:refs/tags/v*'` | Allow only tags with prefix of `v` |\n| `'ref:refs/heads/demo-branch'` | Allow only from branch `demo-branch` |\n| `'pull_request'` | Allow only from pull request |\n| `'environment:Production'` | Allow only from `Production` environment |\n\n<br/>\n\n### Github Actions Workflow\n\nTo actually utilize this in your Github Actions workflow, use [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) to [assume a role](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n\nAt the moment you must use the `master` version (until AWS releases a new tag):\n\n```yaml\njobs:\n deploy:\n name: Upload to Amazon S3\n runs-on: ubuntu-latest\n permissions:\n id-token: write # needed to interact with GitHub's OIDC Token endpoint.\n contents: read\n steps:\n - name: Checkout\n uses: actions/checkout@v2\n\n - name: Configure AWS credentials\n uses: aws-actions/configure-aws-credentials@master\n with:\n role-to-assume: arn:aws:iam::123456789012:role/MyUploadRole\n #role-session-name: MySessionName # Optional\n aws-region: us-east-1\n\n - name: Sync files to S3\n run: |\n aws s3 sync . s3://my-example-bucket\n```\n\n<br/>\n\n### Development Status\n\nThese constructs are fresh out from the oven, since [Github just announced](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) the OpenID Connect feature as generally available. I've been playing around with the feature for some time, but the construct itself haven't yet been widely used.\n\nThese constructs will stay in `v0.x.x` for a while, to allow easier bug fixing & breaking changes _if absolutely needed_. Once bugs are fixed (if any), the constructs will be published with `v1` major version and will be marked as stable.\n\nCurrently only TypeScript, Python and Go versions provided, but before going to stable, I'll probably others (supported by JSII) depending on the amount of work required - so no promises!\n"
3518
3518
  },
3519
3519
  "repository": {
3520
3520
  "type": "git",
@@ -3553,7 +3553,7 @@
3553
3553
  },
3554
3554
  "locationInModule": {
3555
3555
  "filename": "src/provider.ts",
3556
- "line": 55
3556
+ "line": 51
3557
3557
  },
3558
3558
  "parameters": [
3559
3559
  {
@@ -3595,7 +3595,7 @@
3595
3595
  },
3596
3596
  "locationInModule": {
3597
3597
  "filename": "src/provider.ts",
3598
- "line": 39
3598
+ "line": 35
3599
3599
  },
3600
3600
  "name": "fromAccount",
3601
3601
  "parameters": [
@@ -3643,27 +3643,6 @@
3643
3643
  "type": {
3644
3644
  "primitive": "string"
3645
3645
  }
3646
- },
3647
- {
3648
- "const": true,
3649
- "docs": {
3650
- "stability": "experimental"
3651
- },
3652
- "immutable": true,
3653
- "locationInModule": {
3654
- "filename": "src/provider.ts",
3655
- "line": 21
3656
- },
3657
- "name": "thumbprints",
3658
- "static": true,
3659
- "type": {
3660
- "collection": {
3661
- "elementtype": {
3662
- "primitive": "string"
3663
- },
3664
- "kind": "array"
3665
- }
3666
- }
3667
3646
  }
3668
3647
  ],
3669
3648
  "symbolId": "src/provider:GithubActionsIdentityProvider"
@@ -4040,6 +4019,6 @@
4040
4019
  "symbolId": "src/iam-role-props:RoleProps"
4041
4020
  }
4042
4021
  },
4043
- "version": "2.3.3",
4044
- "fingerprint": "1bP7LK9lB2+82VkCyhPsrZ2IvhEoFnMN4fjPg793oT0="
4022
+ "version": "2.3.5",
4023
+ "fingerprint": "JgnHIEtYgNmVAKO2J8nIGGkweUv2YSgdZfGNOMdNS4M="
4045
4024
  }
package/.nvmrc CHANGED
@@ -1 +1 @@
1
- 14.21.1
1
+ 16.20.0
package/API.md CHANGED
@@ -72,12 +72,6 @@ CDK Construct ID given to the construct.
72
72
 
73
73
  ---
74
74
 
75
- ##### `thumbprints` <a name="aws-cdk-github-oidc.GithubActionsIdentityProvider.property.thumbprints"></a>
76
-
77
- - *Type:* `string`[]
78
-
79
- ---
80
-
81
75
  ### GithubActionsRole <a name="aws-cdk-github-oidc.GithubActionsRole"></a>
82
76
 
83
77
  Define an IAM Role that can be assumed by Github Actions workflow via Github OpenID Connect Identity Provider.
package/README.md CHANGED
@@ -7,6 +7,7 @@
7
7
  ---
8
8
 
9
9
  AWS [CDK](https://aws.amazon.com/cdk/) constructs that define:
10
+
10
11
  - Github Actions as OpenID Connect Identity Provider into AWS IAM
11
12
  - IAM Roles that can be assumed by Github Actions workflows
12
13
 
@@ -22,7 +23,6 @@ These constructs allows you to harden your AWS deployment security by removing t
22
23
  - Shout-out to [Richard H. Boyd](https://twitter.com/rchrdbyd) for helping me to debug Github OIDC setup with AWS IAM and his [Deploying to AWS with Github Actions](https://www.githubuniverse.com/2021/session/692586/deploying-to-aws-with-github-actions)-talk.
23
24
  - Shout-out to [Aidan W Steele](https://twitter.com/__steele) and his blog post [AWS federation comes to GitHub Actions](https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html) for being the original inspiration for this.
24
25
 
25
-
26
26
  <br/>
27
27
 
28
28
  ## Getting started
@@ -36,23 +36,28 @@ npm i -D aws-cdk-github-oidc
36
36
  ### OpenID Connect Identity Provider trust for AWS IAM
37
37
 
38
38
  To create a new Github OIDC provider configuration into AWS IAM:
39
+
39
40
  ```ts
40
- import { GithubActionsIdentityProvider } from 'aws-cdk-github-oidc';
41
+ import { GithubActionsIdentityProvider } from "aws-cdk-github-oidc";
41
42
 
42
- const provider = new GithubActionsIdentityProvider(scope, 'GithubProvider');
43
+ const provider = new GithubActionsIdentityProvider(scope, "GithubProvider");
43
44
  ```
44
45
 
45
- In the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws), audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation) and the thumbprint as Github's `a031c46782e6e6c662c2c87c76da9aa62ccabd8e`
46
+ In the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) and audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation).
46
47
 
47
48
  <br/>
48
49
 
49
50
  ### Retrieving a reference to an existing Github OIDC provider configuration
50
51
 
51
52
  Remember, **there can be only one (Github OIDC provider per AWS Account)**, so to retrieve a reference to existing Github OIDC provider use `fromAccount` static method:
53
+
52
54
  ```ts
53
- import { GithubActionsIdentityProvider } from 'aws-cdk-github-oidc';
55
+ import { GithubActionsIdentityProvider } from "aws-cdk-github-oidc";
54
56
 
55
- const provider = GithubActionsIdentityProvider.fromAccount(scope, 'GithubProvider');
57
+ const provider = GithubActionsIdentityProvider.fromAccount(
58
+ scope,
59
+ "GithubProvider"
60
+ );
56
61
  ```
57
62
 
58
63
  <br/>
@@ -60,13 +65,13 @@ const provider = GithubActionsIdentityProvider.fromAccount(scope, 'GithubProvide
60
65
  ### Defining a role for Github Actions workflow to assume
61
66
 
62
67
  ```ts
63
- import { GithubActionsRole } from 'aws-cdk-github-oidc';
68
+ import { GithubActionsRole } from "aws-cdk-github-oidc";
64
69
 
65
- const uploadRole = new GithubActionsRole(scope, 'UploadRole', {
66
- provider: provider, // reference into the OIDC provider
67
- owner: 'octo-org', // your repository owner (organization or user) name
68
- repo: 'octo-repo', // your repository name (without the owner name)
69
- filter: 'ref:refs/tags/v*', // JWT sub suffix filter, defaults to '*'
70
+ const uploadRole = new GithubActionsRole(scope, "UploadRole", {
71
+ provider: provider, // reference into the OIDC provider
72
+ owner: "octo-org", // your repository owner (organization or user) name
73
+ repo: "octo-repo", // your repository name (without the owner name)
74
+ filter: "ref:refs/tags/v*", // JWT sub suffix filter, defaults to '*'
70
75
  });
71
76
 
72
77
  // use it like any other role, for example grant S3 bucket write access:
@@ -74,19 +79,22 @@ myBucket.grantWrite(uploadRole);
74
79
  ```
75
80
 
76
81
  You may pass in any `iam.RoleProps` into the construct's props, except `assumedBy` which will be defined by this construct (CDK will fail if you do):
82
+
77
83
  ```ts
78
- const deployRole = new GithubActionsRole(scope, 'DeployRole', {
84
+ const deployRole = new GithubActionsRole(scope, "DeployRole", {
79
85
  provider: provider,
80
- owner: 'octo-org',
81
- repo: 'octo-repo',
82
- roleName: 'MyDeployRole',
83
- description: 'This role deploys stuff to AWS',
86
+ owner: "octo-org",
87
+ repo: "octo-repo",
88
+ roleName: "MyDeployRole",
89
+ description: "This role deploys stuff to AWS",
84
90
  maxSessionDuration: cdk.Duration.hours(2),
85
91
  });
86
92
 
87
93
  // You may also use various "add*" policy methods!
88
94
  // "AdministratorAccess" not really a good idea, just for an example here:
89
- deployRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'));
95
+ deployRole.addManagedPolicy(
96
+ iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")
97
+ );
90
98
  ```
91
99
 
92
100
  <br/>
@@ -95,7 +103,7 @@ deployRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('Administ
95
103
 
96
104
  By default the value of `filter` property will be `'*'` which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on the [examples in Github Docs](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#configuring-the-oidc-trust-with-the-cloud); For example:
97
105
 
98
- | `filter` value | Descrition |
106
+ | `filter` value | Descrition |
99
107
  | :----------------------------- | :--------------------------------------- |
100
108
  | `'ref:refs/tags/v*'` | Allow only tags with prefix of `v` |
101
109
  | `'ref:refs/heads/demo-branch'` | Allow only from branch `demo-branch` |
@@ -119,19 +127,19 @@ jobs:
119
127
  id-token: write # needed to interact with GitHub's OIDC Token endpoint.
120
128
  contents: read
121
129
  steps:
122
- - name: Checkout
123
- uses: actions/checkout@v2
124
-
125
- - name: Configure AWS credentials
126
- uses: aws-actions/configure-aws-credentials@master
127
- with:
128
- role-to-assume: arn:aws:iam::123456789012:role/MyUploadRole
129
- #role-session-name: MySessionName # Optional
130
- aws-region: us-east-1
131
-
132
- - name: Sync files to S3
133
- run: |
134
- aws s3 sync . s3://my-example-bucket
130
+ - name: Checkout
131
+ uses: actions/checkout@v2
132
+
133
+ - name: Configure AWS credentials
134
+ uses: aws-actions/configure-aws-credentials@master
135
+ with:
136
+ role-to-assume: arn:aws:iam::123456789012:role/MyUploadRole
137
+ #role-session-name: MySessionName # Optional
138
+ aws-region: us-east-1
139
+
140
+ - name: Sync files to S3
141
+ run: |
142
+ aws s3 sync . s3://my-example-bucket
135
143
  ```
136
144
 
137
145
  <br/>
package/lib/provider.d.ts CHANGED
@@ -15,7 +15,6 @@ export interface IGithubActionsIdentityProvider extends iam.IOpenIdConnectProvid
15
15
  */
16
16
  export declare class GithubActionsIdentityProvider extends iam.OpenIdConnectProvider implements IGithubActionsIdentityProvider {
17
17
  static readonly issuer: string;
18
- static readonly thumbprints: string[];
19
18
  /**
20
19
  * Retrieve a reference to existing Github OIDC provider in your AWS account.
21
20
  * An AWS account can only have single Github OIDC provider configured into it,
package/lib/provider.js CHANGED
@@ -27,7 +27,6 @@ class GithubActionsIdentityProvider extends iam.OpenIdConnectProvider {
27
27
  constructor(scope, id) {
28
28
  super(scope, id, {
29
29
  url: `https://${GithubActionsIdentityProvider.issuer}`,
30
- thumbprints: GithubActionsIdentityProvider.thumbprints,
31
30
  clientIds: ['sts.amazonaws.com'],
32
31
  });
33
32
  }
@@ -52,10 +51,6 @@ class GithubActionsIdentityProvider extends iam.OpenIdConnectProvider {
52
51
  }
53
52
  exports.GithubActionsIdentityProvider = GithubActionsIdentityProvider;
54
53
  _a = JSII_RTTI_SYMBOL_1;
55
- GithubActionsIdentityProvider[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "2.3.3" };
54
+ GithubActionsIdentityProvider[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "2.3.5" };
56
55
  GithubActionsIdentityProvider.issuer = 'token.actions.githubusercontent.com';
57
- GithubActionsIdentityProvider.thumbprints = [
58
- 'a031c46782e6e6c662c2c87c76da9aa62ccabd8e',
59
- '6938fd4d98bab03faadb97b34396831e3780aea1',
60
- ];
61
- //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSxtQ0FBbUM7QUFDbkMsMkNBQTJDO0FBUTNDOzs7Ozs7O0dBT0c7QUFDSCxNQUFhLDZCQUE4QixTQUFRLEdBQUcsQ0FBQyxxQkFBcUI7SUEyQjFFOzs7Ozs7Ozs7T0FTRztJQUNILFlBQVksS0FBZ0IsRUFBRSxFQUFVO1FBQ3RDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxFQUFFLFdBQVcsNkJBQTZCLENBQUMsTUFBTSxFQUFFO1lBQ3RELFdBQVcsRUFBRSw2QkFBNkIsQ0FBQyxXQUFXO1lBQ3RELFNBQVMsRUFBRSxDQUFDLG1CQUFtQixDQUFDO1NBQ2pDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFuQ0Q7Ozs7Ozs7Ozs7OztPQVlHO0lBQ0ksTUFBTSxDQUFDLFdBQVcsQ0FBQyxLQUFnQixFQUFFLEVBQVU7UUFDcEQsTUFBTSxTQUFTLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQzlDLE1BQU0sV0FBVyxHQUFHLGdCQUFnQixTQUFTLGtCQUFrQiw2QkFBNkIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN0RyxPQUFPLEdBQUcsQ0FBQyxxQkFBcUIsQ0FBQyw0QkFBNEIsQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7O0FBekJILHNFQTRDQzs7O0FBMUN3QixvQ0FBTSxHQUFXLHFDQUFxQyxDQUFDO0FBQ3ZELHlDQUFXLEdBQWE7SUFDN0MsMENBQTBDO0lBQzFDLDBDQUEwQztDQUMzQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2RrIGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuXG4vKipcbiAqIERlc2NyaWJlcyBhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIgZXh0ZW5kcyBpYW0uSU9wZW5JZENvbm5lY3RQcm92aWRlciB7fVxuXG4vKipcbiAqIEdpdGh1YiBBY3Rpb25zIGFzIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyIGZvciBBV1MgSUFNLlxuICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICpcbiAqIFVzZSBgZnJvbUFjY291bnRgIHRvIHJldHJpZXZlIGEgcmVmZXJlbmNlIHRvIGV4aXN0aW5nIEdpdGh1YiBPSURDIHByb3ZpZGVyLlxuICpcbiAqIEBzZWUgaHR0cHM6Ly9kb2NzLmdpdGh1Yi5jb20vZW4vYWN0aW9ucy9kZXBsb3ltZW50L3NlY3VyaXR5LWhhcmRlbmluZy15b3VyLWRlcGxveW1lbnRzL2NvbmZpZ3VyaW5nLW9wZW5pZC1jb25uZWN0LWluLWFtYXpvbi13ZWItc2VydmljZXNcbiAqL1xuZXhwb3J0IGNsYXNzIEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyIGV4dGVuZHMgaWFtLk9wZW5JZENvbm5lY3RQcm92aWRlciBpbXBsZW1lbnRzIElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciB7XG5cbiAgcHVibGljIHN0YXRpYyByZWFkb25seSBpc3N1ZXI6IHN0cmluZyA9ICd0b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbSc7XG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgdGh1bWJwcmludHM6IHN0cmluZ1tdID0gW1xuICAgICdhMDMxYzQ2NzgyZTZlNmM2NjJjMmM4N2M3NmRhOWFhNjJjY2FiZDhlJyxcbiAgICAnNjkzOGZkNGQ5OGJhYjAzZmFhZGI5N2IzNDM5NjgzMWUzNzgwYWVhMScsXG4gIF07XG5cbiAgLyoqXG4gICAqIFJldHJpZXZlIGEgcmVmZXJlbmNlIHRvIGV4aXN0aW5nIEdpdGh1YiBPSURDIHByb3ZpZGVyIGluIHlvdXIgQVdTIGFjY291bnQuXG4gICAqIEFuIEFXUyBhY2NvdW50IGNhbiBvbmx5IGhhdmUgc2luZ2xlIEdpdGh1YiBPSURDIHByb3ZpZGVyIGNvbmZpZ3VyZWQgaW50byBpdCxcbiAgICogc28gaW50ZXJuYWxseSB0aGUgcmVmZXJlbmNlIGlzIG1hZGUgYnkgY29uc3RydWN0aW5nIHRoZSBBUk4gZnJvbSBBV1NcbiAgICogQWNjb3VudCBJRCAmIEdpdGh1YiBpc3N1ZXIgVVJMLlxuICAgKlxuICAgKiBAcGFyYW0gc2NvcGUgQ0RLIFN0YWNrIG9yIENvbnN0cnVjdCB0byB3aGljaCB0aGUgcHJvdmlkZXIgaXMgYXNzaWduZWQgdG9cbiAgICogQHBhcmFtIGlkIENESyBDb25zdHJ1Y3QgSUQgZ2l2ZW4gdG8gdGhlIGNvbnN0cnVjdFxuICAgKiBAcmV0dXJucyBhIENESyBDb25zdHJ1Y3QgcmVwcmVzZW50aW5nIHRoZSBHaXRodWIgT0lEQyBwcm92aWRlclxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5mcm9tQWNjb3VudChzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKTtcbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUFjY291bnQoc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZyk6IElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciB7XG4gICAgY29uc3QgYWNjb3VudElkID0gY2RrLlN0YWNrLm9mKHNjb3BlKS5hY2NvdW50O1xuICAgIGNvbnN0IHByb3ZpZGVyQXJuID0gYGFybjphd3M6aWFtOjoke2FjY291bnRJZH06b2lkYy1wcm92aWRlci8ke0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn1gO1xuICAgIHJldHVybiBpYW0uT3BlbklkQ29ubmVjdFByb3ZpZGVyLmZyb21PcGVuSWRDb25uZWN0UHJvdmlkZXJBcm4oc2NvcGUsIGlkLCBwcm92aWRlckFybik7XG4gIH1cblxuICAvKipcbiAgICogRGVmaW5lIGEgbmV3IEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQUm92aWRlciBmb3IgQVdTIElBTS5cbiAgICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICAgKlxuICAgKiBAcGFyYW0gc2NvcGUgQ0RLIFN0YWNrIG9yIENvbnN0cnVjdCB0byB3aGljaCB0aGUgcHJvdmlkZXIgaXMgYXNzaWduZWQgdG9cbiAgICogQHBhcmFtIGlkIENESyBDb25zdHJ1Y3QgSUQgZ2l2ZW4gdG8gdGhlIGNvbnN0cnVjdFxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiBuZXcgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIoc2NvcGUsIFwiR2l0aHViUHJvdmlkZXJcIik7XG4gICAqL1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICB1cmw6IGBodHRwczovLyR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfWAsXG4gICAgICB0aHVtYnByaW50czogR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIudGh1bWJwcmludHMsXG4gICAgICBjbGllbnRJZHM6IFsnc3RzLmFtYXpvbmF3cy5jb20nXSxcbiAgICB9KTtcbiAgfVxufVxuIl19
56
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSxtQ0FBbUM7QUFDbkMsMkNBQTJDO0FBUTNDOzs7Ozs7O0dBT0c7QUFDSCxNQUFhLDZCQUE4QixTQUFRLEdBQUcsQ0FBQyxxQkFBcUI7SUF1QjFFOzs7Ozs7Ozs7T0FTRztJQUNILFlBQVksS0FBZ0IsRUFBRSxFQUFVO1FBQ3RDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxFQUFFLFdBQVcsNkJBQTZCLENBQUMsTUFBTSxFQUFFO1lBQ3RELFNBQVMsRUFBRSxDQUFDLG1CQUFtQixDQUFDO1NBQ2pDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFsQ0Q7Ozs7Ozs7Ozs7OztPQVlHO0lBQ0ksTUFBTSxDQUFDLFdBQVcsQ0FBQyxLQUFnQixFQUFFLEVBQVU7UUFDcEQsTUFBTSxTQUFTLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQzlDLE1BQU0sV0FBVyxHQUFHLGdCQUFnQixTQUFTLGtCQUFrQiw2QkFBNkIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN0RyxPQUFPLEdBQUcsQ0FBQyxxQkFBcUIsQ0FBQyw0QkFBNEIsQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7O0FBckJILHNFQXVDQzs7O0FBckN3QixvQ0FBTSxHQUFXLHFDQUFxQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2RrIGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuXG4vKipcbiAqIERlc2NyaWJlcyBhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIgZXh0ZW5kcyBpYW0uSU9wZW5JZENvbm5lY3RQcm92aWRlciB7IH1cblxuLyoqXG4gKiBHaXRodWIgQWN0aW9ucyBhcyBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAqIFRoZXJlIGNhbiBiZSBvbmx5IG9uZSAocGVyIEFXUyBBY2NvdW50KS5cbiAqXG4gKiBVc2UgYGZyb21BY2NvdW50YCB0byByZXRyaWV2ZSBhIHJlZmVyZW5jZSB0byBleGlzdGluZyBHaXRodWIgT0lEQyBwcm92aWRlci5cbiAqXG4gKiBAc2VlIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9jb25maWd1cmluZy1vcGVuaWQtY29ubmVjdC1pbi1hbWF6b24td2ViLXNlcnZpY2VzXG4gKi9cbmV4cG9ydCBjbGFzcyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciBleHRlbmRzIGlhbS5PcGVuSWRDb25uZWN0UHJvdmlkZXIgaW1wbGVtZW50cyBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIge1xuXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgaXNzdWVyOiBzdHJpbmcgPSAndG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20nO1xuXG4gIC8qKlxuICAgKiBSZXRyaWV2ZSBhIHJlZmVyZW5jZSB0byBleGlzdGluZyBHaXRodWIgT0lEQyBwcm92aWRlciBpbiB5b3VyIEFXUyBhY2NvdW50LlxuICAgKiBBbiBBV1MgYWNjb3VudCBjYW4gb25seSBoYXZlIHNpbmdsZSBHaXRodWIgT0lEQyBwcm92aWRlciBjb25maWd1cmVkIGludG8gaXQsXG4gICAqIHNvIGludGVybmFsbHkgdGhlIHJlZmVyZW5jZSBpcyBtYWRlIGJ5IGNvbnN0cnVjdGluZyB0aGUgQVJOIGZyb20gQVdTXG4gICAqIEFjY291bnQgSUQgJiBHaXRodWIgaXNzdWVyIFVSTC5cbiAgICpcbiAgICogQHBhcmFtIHNjb3BlIENESyBTdGFjayBvciBDb25zdHJ1Y3QgdG8gd2hpY2ggdGhlIHByb3ZpZGVyIGlzIGFzc2lnbmVkIHRvXG4gICAqIEBwYXJhbSBpZCBDREsgQ29uc3RydWN0IElEIGdpdmVuIHRvIHRoZSBjb25zdHJ1Y3RcbiAgICogQHJldHVybnMgYSBDREsgQ29uc3RydWN0IHJlcHJlc2VudGluZyB0aGUgR2l0aHViIE9JREMgcHJvdmlkZXJcbiAgICpcbiAgICogQGV4YW1wbGVcbiAgICogR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnQoc2NvcGUsIFwiR2l0aHViUHJvdmlkZXJcIik7XG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGZyb21BY2NvdW50KHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcpOiBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIge1xuICAgIGNvbnN0IGFjY291bnRJZCA9IGNkay5TdGFjay5vZihzY29wZSkuYWNjb3VudDtcbiAgICBjb25zdCBwcm92aWRlckFybiA9IGBhcm46YXdzOmlhbTo6JHthY2NvdW50SWR9Om9pZGMtcHJvdmlkZXIvJHtHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5pc3N1ZXJ9YDtcbiAgICByZXR1cm4gaWFtLk9wZW5JZENvbm5lY3RQcm92aWRlci5mcm9tT3BlbklkQ29ubmVjdFByb3ZpZGVyQXJuKHNjb3BlLCBpZCwgcHJvdmlkZXJBcm4pO1xuICB9XG5cbiAgLyoqXG4gICAqIERlZmluZSBhIG5ldyBHaXRodWIgT3BlbklEIENvbm5lY3QgSWRlbnRpdHkgUFJvdmlkZXIgZm9yIEFXUyBJQU0uXG4gICAqIFRoZXJlIGNhbiBiZSBvbmx5IG9uZSAocGVyIEFXUyBBY2NvdW50KS5cbiAgICpcbiAgICogQHBhcmFtIHNjb3BlIENESyBTdGFjayBvciBDb25zdHJ1Y3QgdG8gd2hpY2ggdGhlIHByb3ZpZGVyIGlzIGFzc2lnbmVkIHRvXG4gICAqIEBwYXJhbSBpZCBDREsgQ29uc3RydWN0IElEIGdpdmVuIHRvIHRoZSBjb25zdHJ1Y3RcbiAgICpcbiAgICogQGV4YW1wbGVcbiAgICogbmV3IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyKHNjb3BlLCBcIkdpdGh1YlByb3ZpZGVyXCIpO1xuICAgKi9cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgdXJsOiBgaHR0cHM6Ly8ke0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn1gLFxuICAgICAgY2xpZW50SWRzOiBbJ3N0cy5hbWF6b25hd3MuY29tJ10sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==
package/lib/role.js CHANGED
@@ -101,5 +101,5 @@ class GithubActionsRole extends iam.Role {
101
101
  }
102
102
  exports.GithubActionsRole = GithubActionsRole;
103
103
  _a = JSII_RTTI_SYMBOL_1;
104
- GithubActionsRole[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "2.3.3" };
104
+ GithubActionsRole[_a] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "2.3.5" };
105
105
  //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsbUNBQW1DO0FBQ25DLDJDQUEyQztBQUczQyxpREFBaUQ7QUFDakQseUNBQTJGO0FBb0UzRjs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FpQkc7QUFDSCxNQUFhLGlCQUFrQixTQUFRLEdBQUcsQ0FBQyxJQUFJO0lBcUM3Qzs7Ozs7Ozs7Ozs7Ozs7Ozs7T0FpQkc7SUFDSCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQTZCO1FBRXJFLE1BQU0sRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxHQUFHLEtBQUssQ0FBQztRQUV4QyxzQkFBc0I7UUFDdEIsaUJBQWlCLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQztRQUM5QyxpQkFBaUIsQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBRTVDLGlCQUFpQjtRQUNqQixNQUFNLE9BQU8sR0FBRyxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkQsTUFBTSxTQUFTLEdBQUcsaUJBQWlCLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFNUQsK0JBQStCO1FBQy9CLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxTQUFTO1lBQ1osU0FBUyxFQUFFLElBQUksR0FBRyxDQUFDLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyx3QkFBd0IsRUFBRTtnQkFDekUsVUFBVSxFQUFFO29CQUNWLG9EQUFvRDtvQkFDcEQsQ0FBQyxHQUFHLHdDQUE2QixDQUFDLE1BQU0sTUFBTSxDQUFDLEVBQUUsT0FBTztpQkFDekQ7Z0JBQ0QsWUFBWSxFQUFFO29CQUNaLHVFQUF1RTtvQkFDdkUsMEtBQTBLO29CQUMxSyxDQUFDLEdBQUcsd0NBQTZCLENBQUMsTUFBTSxNQUFNLENBQUMsRUFBRSxtQkFBbUI7aUJBQ3JFO2FBQ0YsQ0FBQztTQUNILENBQUMsQ0FBQztJQUVMLENBQUM7SUFqRkQ7Ozs7T0FJRztJQUNLLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxLQUE2QjtRQUMzRCxNQUFNLFlBQVksR0FBUSxLQUFLLENBQUM7UUFDaEMsT0FBTyxZQUFZLENBQUMsUUFBUSxDQUFDO1FBQzdCLE9BQU8sWUFBWSxDQUFDLEtBQUssQ0FBQztRQUMxQixPQUFPLFlBQVksQ0FBQyxJQUFJLENBQUM7UUFDekIsT0FBTyxZQUFZLENBQUMsTUFBTSxDQUFDO1FBQzNCLE9BQU8sWUFBWSxDQUFDO0lBQ3RCLENBQUM7SUFFRCw4REFBOEQ7SUFDdEQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFnQixFQUFFLEtBQWE7UUFDMUQsSUFBSSxzQkFBbUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQzVDLEdBQUcsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsQ0FBQyxvQ0FBb0MsS0FBSywwS0FBMEssQ0FBQyxDQUFDO1NBQ3pQO0lBQ0gsQ0FBQztJQUVELDREQUE0RDtJQUNwRCxNQUFNLENBQUMsWUFBWSxDQUFDLEtBQWdCLEVBQUUsSUFBWTtRQUN4RCxJQUFJLElBQUksS0FBSyxFQUFFLEVBQUU7WUFDZixHQUFHLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQUMsbUNBQW1DLElBQUksNkJBQTZCLENBQUMsQ0FBQztTQUMxRztJQUNILENBQUM7SUFFRCxvREFBb0Q7SUFDNUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUEwQjtRQUNyRCxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxNQUFNLEdBQUcsR0FBRyxFQUFFLEdBQUcsS0FBSyxDQUFDO1FBQzVDLE9BQU8sUUFBUSxLQUFLLElBQUksSUFBSSxJQUFJLE1BQU0sRUFBRSxDQUFDO0lBQzNDLENBQUM7O0FBbENILDhDQW9GQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGNkayBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IFJvbGVQcm9wcyB9IGZyb20gJy4vaWFtLXJvbGUtcHJvcHMnO1xuaW1wb3J0IGdpdGh1YlVzZXJuYW1lUmVnZXggZnJvbSAnLi9vd25lci1yZWdleHAnO1xuaW1wb3J0IHsgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIsIElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciB9IGZyb20gJy4vcHJvdmlkZXInO1xuXG4vKipcbiAqIEdpdGh1YiByZWxhdGVkIGNvbmZpZ3VyYXRpb24gdGhhdCBmb3JtcyB0aGUgdHJ1c3QgcG9saWN5IGZvciB0aGlzIElBTSBSb2xlLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdpdGh1YkNvbmZpZ3VyYXRpb24ge1xuXG4gIC8qKlxuICAgKiBSZWZlcmVuY2UgdG8gR2l0aHViIE9wZW5JRCBDb25uZWN0IFByb3ZpZGVyIGNvbmZpZ3VyZWQgaW4gQVdTIElBTS5cbiAgICpcbiAgICogRWl0aGVyIHBhc3MgYW4gY29uc3RydWN0IGRlZmluZWQgYnkgYG5ldyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcmBcbiAgICogb3IgYSByZXRyaWV2ZWQgcmVmZXJlbmNlIGZyb20gYEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmZyb21BY2NvdW50YC5cbiAgICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICAgKi9cbiAgcmVhZG9ubHkgcHJvdmlkZXI6IElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcjtcblxuICAvKipcbiAgICogUmVwb3NpdG9yeSBvd25lciAob3JnYW5pemF0aW9uIG9yIHVzZXJuYW1lKS5cbiAgICpcbiAgICogQGV4YW1wbGVcbiAgICogJ29jdG8tb3JnJ1xuICAgKi9cbiAgcmVhZG9ubHkgb3duZXI6IHN0cmluZztcblxuICAvKipcbiAgICogUmVwb3NpdG9yeSBuYW1lIChzbHVnKSB3aXRob3V0IHRoZSBvd25lci5cbiAgICpcbiAgICogQGV4YW1wbGVcbiAgICogJ29jdG8tcmVwbydcbiAgICovXG4gIHJlYWRvbmx5IHJlcG86IHN0cmluZztcblxuICAvKipcbiAgICogU3ViamVjdCBjb25kaXRpb24gZmlsdGVyLCBhcHBlbmRlZCBhZnRlciBgcmVwbzoke293bmVyfS8ke3JlcG99OmAgc3RyaW5nIGluIElBTSBSb2xlIHRydXN0IHJlbGF0aW9uc2hpcC5cbiAgICpcbiAgICogQGRlZmF1bHRcbiAgICogJyonXG4gICAqXG4gICAqIFlvdSBtYXkgdXNlIHRoaXMgdmFsdWUgdG8gb25seSBhbGxvdyBHaXRodWIgdG8gYXNzdW1lIHRoZSByb2xlIG9uIHNwZWNpZmljIGJyYW5jaGVzLCB0YWdzLCBlbnZpcm9ubWVudHMsIHB1bGwgcmVxdWVzdHMgZXRjLlxuICAgKiBAZXhhbXBsZVxuICAgKiAncmVmOnJlZnMvdGFncy92KidcbiAgICogJ3JlZjpyZWZzL2hlYWRzL2RlbW8tYnJhbmNoJ1xuICAgKiAncHVsbF9yZXF1ZXN0J1xuICAgKiAnZW52aXJvbm1lbnQ6UHJvZHVjdGlvbidcbiAgICpcbiAgICogQHNlZSBodHRwczovL2RvY3MuZ2l0aHViLmNvbS9lbi9hY3Rpb25zL2RlcGxveW1lbnQvc2VjdXJpdHktaGFyZGVuaW5nLXlvdXItZGVwbG95bWVudHMvYWJvdXQtc2VjdXJpdHktaGFyZGVuaW5nLXdpdGgtb3BlbmlkLWNvbm5lY3QjZXhhbXBsZXNcbiAgICovXG4gIHJlYWRvbmx5IGZpbHRlcj86IHN0cmluZztcbn1cblxuLyoqXG4gKiBQcm9wcyB0aGF0IGRlZmluZSB0aGUgSUFNIFJvbGUgdGhhdCBjYW4gYmUgYXNzdW1lZCBieSBHaXRodWIgQWN0aW9ucyB3b3JrZmxvd1xuICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAqXG4gKiBCZXNpZGVzIGBHaXRodWJDb25maWd1cmF0aW9uYCwgeW91IG1heSBwYXNzIGluIGFueSBgaWFtLlJvbGVQcm9wc2AgZXhjZXB0IGBhc3N1bWVkQnlgXG4gKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAqXG4gKiBAZXhhbXBsZVxuICoge1xuICogICBwcm92aWRlcjogR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnQoc2NvcGUsIFwiR2l0aHViUHJvdmlkZXJcIiksXG4gKiAgIG93bmVyOiAnb2N0by1vcmcnLFxuICogICByZXBvOiAnb2N0by1yZXBvJyxcbiAqICAgZmlsdGVyOiAncmVmOnJlZnMvdGFncy92KicsXG4gKiAgIHJvbGVOYW1lOiAnTXlEZXBsb3lSb2xlJyxcbiAqIH1cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBHaXRodWJBY3Rpb25zUm9sZVByb3BzIGV4dGVuZHMgR2l0aHViQ29uZmlndXJhdGlvbiwgUm9sZVByb3BzIHt9XG5cbi8qKlxuICogRGVmaW5lIGFuIElBTSBSb2xlIHRoYXQgY2FuIGJlIGFzc3VtZWQgYnkgR2l0aHViIEFjdGlvbnMgd29ya2Zsb3dcbiAqIHZpYSBHaXRodWIgT3BlbklEIENvbm5lY3QgSWRlbnRpdHkgUHJvdmlkZXIuXG4gKlxuICogQmVzaWRlcyBgR2l0aHViQ29uZmlndXJhdGlvbmAsIHlvdSBtYXkgcGFzcyBpbiBhbnkgYGlhbS5Sb2xlUHJvcHNgIGV4Y2VwdCBgYXNzdW1lZEJ5YFxuICogd2hpY2ggd2lsbCBiZSBkZWZpbmVkIGJ5IHRoaXMgY29uc3RydWN0IChDREsgd2lsbCBmYWlsIGlmIHlvdSBkbykuXG4gKlxuICogQGV4YW1wbGVcbiAqIGNvbnN0IHVwbG9hZFJvbGUgPSBuZXcgR2l0aHViQWN0aW9uc1JvbGUoc2NvcGUsIFwiVXBsb2FkUm9sZVwiLCB7XG4gKiAgIHByb3ZpZGVyOiBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5mcm9tQWNjb3VudChzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKSxcbiAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gKiAgIHJlcG86ICdvY3RvLXJlcG8nLFxuICogICBmaWx0ZXI6ICdyZWY6cmVmcy90YWdzL3YqJyxcbiAqICAgcm9sZU5hbWU6ICdNeVVwbG9hZFJvbGUnLFxuICogfSk7XG4gKlxuICogbXlCdWNrZXQuZ3JhbnRXcml0ZSh1cGxvYWRSb2xlKTtcbiAqL1xuZXhwb3J0IGNsYXNzIEdpdGh1YkFjdGlvbnNSb2xlIGV4dGVuZHMgaWFtLlJvbGUge1xuXG4gIC8qKlxuICAgKiBFeHRyYWN0cyBwcm9wcyBnaXZlbiBmb3IgdGhlIGNyZWF0ZWQgSUFNIFJvbGUgQ29uc3RydWN0LlxuICAgKiBAcGFyYW0gcHJvcHMgZm9yIHRoZSBHaXRodWJBY3Rpb25zUm9sZVxuICAgKiBAcmV0dXJucyBmb3IgdGhlIElBTSBSb2xlXG4gICAqL1xuICBwcml2YXRlIHN0YXRpYyBleHRyYWN0Um9sZVByb3BzKHByb3BzOiBHaXRodWJBY3Rpb25zUm9sZVByb3BzKTogaWFtLlJvbGVQcm9wcyB7XG4gICAgY29uc3QgZXh0cmFjdFByb3BzID0gPGFueT5wcm9wcztcbiAgICBkZWxldGUgZXh0cmFjdFByb3BzLnByb3ZpZGVyO1xuICAgIGRlbGV0ZSBleHRyYWN0UHJvcHMub3duZXI7XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5yZXBvO1xuICAgIGRlbGV0ZSBleHRyYWN0UHJvcHMuZmlsdGVyO1xuICAgIHJldHVybiBleHRyYWN0UHJvcHM7XG4gIH1cblxuICAvKiogVmFsaWRhdGVzIHRoZSBHaXRodWIgb3duZXIgKG9yZ2FuaXphdGlvbiBvciB1c2VyKSBuYW1lLiAqL1xuICBwcml2YXRlIHN0YXRpYyB2YWxpZGF0ZU93bmVyKHNjb3BlOiBDb25zdHJ1Y3QsIG93bmVyOiBzdHJpbmcpOiB2b2lkIHtcbiAgICBpZiAoZ2l0aHViVXNlcm5hbWVSZWdleC50ZXN0KG93bmVyKSAhPT0gdHJ1ZSkge1xuICAgICAgY2RrLkFubm90YXRpb25zLm9mKHNjb3BlKS5hZGRFcnJvcihgSW52YWxpZCBHaXRodWIgUmVwb3NpdG9yeSBPd25lciBcIiR7b3duZXJ9XCIuIE11c3Qgb25seSBjb250YWluIGFscGhhbnVtZXJpYyBjaGFyYWN0ZXJzIG9yIGh5cGhlbnMsIGNhbm5vdCBoYXZlIG11bHRpcGxlIGNvbnNlY3V0aXZlIGh5cGhlbnMsIGNhbm5vdCBiZWdpbiBvciBlbmQgd2l0aCBhIGh5cGVuIGFuZCBtYXhpbXVtIGxlbmdodCBpcyAzOSBjaGFyYWN0ZXJzLmApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBWYWxpZGF0ZXMgdGhlIEdpdGh1YiByZXBvc2l0b3J5IG5hbWUgKHdpdGhvdXQgb3duZXIpLiAqL1xuICBwcml2YXRlIHN0YXRpYyB2YWxpZGF0ZVJlcG8oc2NvcGU6IENvbnN0cnVjdCwgcmVwbzogc3RyaW5nKTogdm9pZCB7XG4gICAgaWYgKHJlcG8gPT09ICcnKSB7XG4gICAgICBjZGsuQW5ub3RhdGlvbnMub2Yoc2NvcGUpLmFkZEVycm9yKGBJbnZhbGlkIEdpdGh1YiBSZXBvc2l0b3J5IE5hbWUgXCIke3JlcG99XCIuIE1heSBub3QgYmUgZW1wdHkgc3RyaW5nLmApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBGb3JtYXRzIHRoZSBgc3ViYCB2YWx1ZSB1c2VkIGluIHRydXN0IHBvbGljeS4gKi9cbiAgcHJpdmF0ZSBzdGF0aWMgZm9ybWF0U3ViamVjdChwcm9wczogR2l0aHViQ29uZmlndXJhdGlvbik6IHN0cmluZyB7XG4gICAgY29uc3QgeyBvd25lciwgcmVwbywgZmlsdGVyID0gJyonIH0gPSBwcm9wcztcbiAgICByZXR1cm4gYHJlcG86JHtvd25lcn0vJHtyZXBvfToke2ZpbHRlcn1gO1xuICB9XG5cblxuICAvKipcbiAgICogRGVmaW5lIGFuIElBTSBSb2xlIHRoYXQgY2FuIGJlIGFzc3VtZWQgYnkgR2l0aHViIEFjdGlvbnMgd29ya2Zsb3dcbiAgICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAgICpcbiAgICogQmVzaWRlcyBgR2l0aHViQ29uZmlndXJhdGlvbmAsIHlvdSBtYXkgcGFzcyBpbiBhbnkgYGlhbS5Sb2xlUHJvcHNgIGV4Y2VwdCBgYXNzdW1lZEJ5YFxuICAgKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAgICpcbiAgICogQGV4YW1wbGVcbiAgICogY29uc3QgdXBsb2FkUm9sZSA9IG5ldyBHaXRodWJBY3Rpb25zUm9sZShzY29wZSwgXCJVcGxvYWRSb2xlXCIsIHtcbiAgICogICBwcm92aWRlcjogR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnQoc2NvcGUsIFwiR2l0aHViUHJvdmlkZXJcIiksXG4gICAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gICAqICAgcmVwbzogJ29jdG8tcmVwbycsXG4gICAqICAgZmlsdGVyOiAncmVmOnJlZnMvdGFncy92KicsXG4gICAqICAgcm9sZU5hbWU6ICdNeVVwbG9hZFJvbGUnLFxuICAgKiB9KTtcbiAgICpcbiAgICogbXlCdWNrZXQuZ3JhbnRXcml0ZSh1cGxvYWRSb2xlKTtcbiAgICovXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBHaXRodWJBY3Rpb25zUm9sZVByb3BzKSB7XG5cbiAgICBjb25zdCB7IHByb3ZpZGVyLCBvd25lciwgcmVwbyB9ID0gcHJvcHM7XG5cbiAgICAvLyBQZXJmb3JtIHZhbGlkYXRpb25zXG4gICAgR2l0aHViQWN0aW9uc1JvbGUudmFsaWRhdGVPd25lcihzY29wZSwgb3duZXIpO1xuICAgIEdpdGh1YkFjdGlvbnNSb2xlLnZhbGlkYXRlUmVwbyhzY29wZSwgcmVwbyk7XG5cbiAgICAvLyBQcmVwYXJlIHZhbHVlc1xuICAgIGNvbnN0IHN1YmplY3QgPSBHaXRodWJBY3Rpb25zUm9sZS5mb3JtYXRTdWJqZWN0KHByb3BzKTtcbiAgICBjb25zdCByb2xlUHJvcHMgPSBHaXRodWJBY3Rpb25zUm9sZS5leHRyYWN0Um9sZVByb3BzKHByb3BzKTtcblxuICAgIC8vIFRoZSBhY3R1YWwgSUFNIFJvbGUgY3JlYXRpb25cbiAgICBzdXBlcihzY29wZSwgaWQsIHtcbiAgICAgIC4uLnJvbGVQcm9wcyxcbiAgICAgIGFzc3VtZWRCeTogbmV3IGlhbS5XZWJJZGVudGl0eVByaW5jaXBhbChwcm92aWRlci5vcGVuSWRDb25uZWN0UHJvdmlkZXJBcm4sIHtcbiAgICAgICAgU3RyaW5nTGlrZToge1xuICAgICAgICAgIC8vIE9ubHkgYWxsb3cgc3BlY2lmaWVkIHN1YmplY3RzIHRvIGFzc3VtZSB0aGlzIHJvbGVcbiAgICAgICAgICBbYCR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfTpzdWJgXTogc3ViamVjdCxcbiAgICAgICAgfSxcbiAgICAgICAgU3RyaW5nRXF1YWxzOiB7XG4gICAgICAgICAgLy8gQXVkaWVuY2UgaXMgYWx3YXlzIHN0cy5hbWF6b25hd3MuY29tIHdpdGggQVdTIG9mZmljaWFsIEdpdGh1YiBBY3Rpb25cbiAgICAgICAgICAvLyBodHRwczovL2RvY3MuZ2l0aHViLmNvbS9lbi9hY3Rpb25zL2RlcGxveW1lbnQvc2VjdXJpdHktaGFyZGVuaW5nLXlvdXItZGVwbG95bWVudHMvY29uZmlndXJpbmctb3BlbmlkLWNvbm5lY3QtaW4tYW1hem9uLXdlYi1zZXJ2aWNlcyNhZGRpbmctdGhlLWlkZW50aXR5LXByb3ZpZGVyLXRvLWF3c1xuICAgICAgICAgIFtgJHtHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5pc3N1ZXJ9OmF1ZGBdOiAnc3RzLmFtYXpvbmF3cy5jb20nLFxuICAgICAgICB9LFxuICAgICAgfSksXG4gICAgfSk7XG5cbiAgfVxufVxuXG4iXX0=
package/package.json CHANGED
@@ -40,7 +40,7 @@
40
40
  "devDependencies": {
41
41
  "@types/github-username-regex": "^1.0.0",
42
42
  "@types/jest": "^27",
43
- "@types/node": "^14",
43
+ "@types/node": "^16",
44
44
  "@typescript-eslint/eslint-plugin": "^5",
45
45
  "@typescript-eslint/parser": "^5",
46
46
  "aws-cdk-lib": "2.89.0",
@@ -82,11 +82,11 @@
82
82
  "openid-connect"
83
83
  ],
84
84
  "engines": {
85
- "node": ">= 14.21.1"
85
+ "node": ">= 16.20.0"
86
86
  },
87
87
  "main": "lib/index.js",
88
88
  "license": "Apache-2.0",
89
- "version": "2.3.3",
89
+ "version": "2.3.5",
90
90
  "jest": {
91
91
  "testMatch": [
92
92
  "<rootDir>/src/**/__tests__/**/*.ts?(x)",