aws-cdk-github-oidc 5.1.1 → 5.2.0

package/.jsii

@@ -9035,7 +9035,7 @@
   },
   "name": "aws-cdk-github-oidc",
   "readme": {
-    "markdown": "> [!IMPORTANT]\n> Migrating **to `v4`**? See [Migration Guide](#migration-guide) at the end of this README.\n\n\n# AWS CDK Github OpenID Connect\n\n![cdk-support](https://img.shields.io/badge/cdk-%20typescript%20|%20python%20-informational \"TypeScript | Python\")\n[![release](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml/badge.svg)](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml)\n[![codecov](https://codecov.io/gh/aripalo/aws-cdk-github-oidc/branch/main/graph/badge.svg?token=5X44RM6J17)](https://codecov.io/gh/aripalo/aws-cdk-github-oidc)\n\n---\n\nAWS [CDK](https://aws.amazon.com/cdk/) constructs that define:\n\n- Github Actions as OpenID Connect Identity Provider into AWS IAM\n- IAM Roles that can be assumed by Github Actions workflows\n\nThese constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.\n\n## Background information\n\n![github-aws-oidc](/assets/github-aws-oidc.svg \"Github OIDC with AWS\")\n\n- [GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) on Github Changelog Blog.\n- [Security hardening your deployments](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments) on Github Docs.\n- [Assuming a role with `aws-actions/configure-aws-credentials`](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n- Shout-out to [Richard H. Boyd](https://twitter.com/rchrdbyd) for helping me to debug Github OIDC setup with AWS IAM and his [Deploying to AWS with Github Actions](https://www.githubuniverse.com/2021/session/692586/deploying-to-aws-with-github-actions)-talk.\n- Shout-out to [Aidan W Steele](https://twitter.com/__steele) and his blog post [AWS federation comes to GitHub Actions](https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html) for being the original inspiration for this.\n\n<br/>\n\n## Getting started\n\n```shell\npnpm add -D aws-cdk-github-oidc\n```\n\n<br/>\n\n### OpenID Connect Identity Provider trust for AWS IAM\n\nTo create a new Github OIDC provider configuration into AWS IAM:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = new GithubActionsIdentityProvider(scope, \"GithubProvider\");\n```\n\nIn the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) and audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation).\n\n<br/>\n\n### Retrieving a reference to an existing Github OIDC provider configuration\n\nRemember, **there can be only one (Github OIDC provider per AWS Account)**, so to retrieve a reference to existing Github OIDC provider use `fromAccount` static method:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = GithubActionsIdentityProvider.fromAccount(\n  scope,\n  \"GithubProvider\"\n);\n```\n\n<br/>\n\n### Defining a role for Github Actions workflow to assume\n\n```ts\nimport { GithubActionsRole } from \"aws-cdk-github-oidc\";\n\nconst uploadRole = new GithubActionsRole(scope, \"UploadRole\", {\n  provider: provider, // reference into the OIDC provider\n  owner: \"octo-org\", // your repository owner (organization or user) name\n  repo: \"octo-repo\", // your repository name (without the owner name)\n  filter: \"ref:refs/tags/v*\", // JWT sub suffix filter, defaults to '*'\n});\n\n// use it like any other role, for example grant S3 bucket write access:\nmyBucket.grantWrite(uploadRole);\n```\n\nYou may pass in any `iam.RoleProps` into the construct's props, except `assumedBy` which will be defined by this construct (CDK will fail if you do):\n\n```ts\nconst deployRole = new GithubActionsRole(scope, \"DeployRole\", {\n  provider: provider,\n  owner: \"octo-org\",\n  repo: \"octo-repo\",\n  roleName: \"MyDeployRole\",\n  description: \"This role deploys stuff to AWS\",\n  maxSessionDuration: cdk.Duration.hours(2),\n});\n\n// You may also use various \"add*\" policy methods!\n// \"AdministratorAccess\" not really a good idea, just for an example here:\ndeployRole.addManagedPolicy(\n  iam.ManagedPolicy.fromAwsManagedPolicyName(\"AdministratorAccess\")\n);\n```\n\n<br/>\n\n#### Subject Filter\n\nBy default the value of `filter` property will be `'*'` which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on the [examples in Github Docs](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#configuring-the-oidc-trust-with-the-cloud); For example:\n\n| `filter` value                 | Descrition                               |\n| :----------------------------- | :--------------------------------------- |\n| `'ref:refs/tags/v*'`           | Allow only tags with prefix of `v`       |\n| `'ref:refs/heads/demo-branch'` | Allow only from branch `demo-branch`     |\n| `'pull_request'`               | Allow only from pull request             |\n| `'environment:Production'`     | Allow only from `Production` environment |\n\n<br/>\n\n#### Immutable Subject\n\nGive both `ownerId` and `repoId` to form the trust policy with an [immutable subject](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims):\n\n```ts\nconst deployRole = new GithubActionsRole(scope, \"DeployRole\", {\n  provider: provider,\n  owner: \"octo-org\",\n  repo: \"octo-repo\",\n  ownerId: \"123456\", // your repository owner ID\n  repoId: \"456789\", // your repository ID\n  filter: \"ref:refs/tags/v*\",\n});\n```\n\nWhich results in a subject condition of `repo:octo-org@123456/octo-repo@456789:ref:refs/tags/v*` instead of `repo:octo-org/octo-repo:ref:refs/tags/v*`. Both properties must be given together, as CDK will fail if you only provide one of them.\n\n> [!IMPORTANT]\n> Ensure Github actually [issues an immutable subject](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims) for your repository **before** deploying a role which requires one, as otherwise `sts:AssumeRoleWithWebIdentity` will be denied.\n\n<br/>\n\n### Github Actions Workflow\n\nTo actually utilize this in your Github Actions workflow, use [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) to [assume a role](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n\n```yaml\njobs:\n  whoami:\n    name: Who Am I\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write # needed to interact with GitHub's OIDC Token endpoint.\n    steps:\n      - name: Configure AWS credentials\n        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1\n        with:\n          role-to-assume: arn:aws:iam::123456789012:role/MyUploadRole\n          #role-session-name: MySessionName # Optional\n          aws-region: us-east-1\n      - name: Get Caller Identity\n        run: |\n          aws sts get-caller-identity\n```\n\n<br/>\n\n\n## Migration Guide\n\n- [v2→v3](#v2v3)\n- [v3→v4](#v3v4)\n\n### v2→v3\n\n1. Install AWS CDK version [`v2.237.0`](https://github.com/aws/aws-cdk/releases/tag/v2.237.0) or newer required (due to support of [OIDC provider removal policy](https://github.com/aws/aws-cdk/commit/09383cbad28336441f0fb405c9d8a190135620dc)):\n\n    ```sh\n    pnpm add -D aws-cdk-lib@^2.237.0\n    ```\n\n2. Install `v3.1.0` (or newer v3 release) of this library:\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^3.1\n    ```\n\n3. No additional steps required, as the v3 major version does not introduce any breaking changes (just a lot of internal tooling changes).\n\n### v3→v4\n\n> [!CAUTION]\n> The following steps describe a _**no-downtime** migration path_.\n> It is the recommended approach, but somewhat _involved_: Hence some users may decide to use \"destroy + redeploy\" strategy instead, which causes downtime to authenticating from GitHub Actions to AWS using OIDC.\n\n1. Ensure you are running `v3.1.0` (or newer v3 release) of this library, see [v2→v3](#v2v3).\n\n2. Configure `RETAIN` removal policy for the provider:\n\n    ```diff\n    const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    });\n    ```\n\n3. Run `pnpm exec cdk diff`, which will show an output similar to:\n\n    ```sh\n    Resources\n    [~] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB\n    ├─ [~] DeletionPolicy\n    │   ├─ [-] Delete\n    │   └─ [+] Retain\n    └─ [~] UpdateReplacePolicy\n        ├─ [-] Delete\n        └─ [+] Retain\n    ```\n\n\n4. Deploy the changes `pnpm exec cdk deploy`\n\n5. Once the `RETAIN` removal policy has been successfully deployed, upgrade this library to `v4.2` (or newer v4 release):\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^4.2\n    ```\n\n6. Temporarily change from provider initializion to provider lookup:\n\n    ```diff\n    - const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    -  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    - });\n    + const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\"); // NOTICE the different construct ID\n    ```\n    ⚠️ **Notice the different construct ID** (in the example `GithubProviderReference` instead of ~~`GithubProvider`~~). This is required so that the CDK treats the GitHub OIDC provider lookup as a different \"thing\" and does not try to change the type of existing construct.\n\n7. Check `pnpm exec cdk diff` which should look similar to:\n    ```sh\n    Resources\n    [-] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB orphan\n    [-] AWS::IAM::Role Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Role CustomAWSCDKOpenIdConnectProviderCustomResourceProviderRole517FED65 destroy\n    [-] AWS::Lambda::Function Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Handler CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0 destroy\n    ```\n\n8. Deploy the changes with `pnpm exec cdk deploy`\n\n9. Once the deployment has succeeded, remove the provider lookup and replace it with the original provider initialization:\n\n    ```diff\n    - const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\");\n    + const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    + });\n    ```\n\n10. Copy the ARN of the existing OIDC provider, it will be in the format of:\n\n    ```\n    arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com # REPLACE with your account ID\n    ```\n\n11. Use [cdk import](https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-import.html):\n\n    ```sh\n    pnpm exec cdk import <YOUR_STACK_NAME>\n    ```\n\n    ... and when asked, input the provider ARN you copied in step 10:\n    ```sh\n    <YOUR_STACK_NAME>/GithubProvider/Resource (AWS::IAM::OIDCProvider): enter Arn (empty to skip)\n    ```\n\n12. You should be done now, but you may want to **perform manual verification** in addition to [drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html) and/or `cdk diff``\u001b to verify.\n\n\n\n"
+    "markdown": "> [!IMPORTANT]\n> Migrating **to `v4`**? See [Migration Guide](#migration-guide) at the end of this README.\n\n\n# AWS CDK Github OpenID Connect\n\n![cdk-support](https://img.shields.io/badge/cdk-%20typescript%20|%20python%20-informational \"TypeScript | Python\")\n[![release](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml/badge.svg)](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml)\n[![codecov](https://codecov.io/gh/aripalo/aws-cdk-github-oidc/branch/main/graph/badge.svg?token=5X44RM6J17)](https://codecov.io/gh/aripalo/aws-cdk-github-oidc)\n\n---\n\nAWS [CDK](https://aws.amazon.com/cdk/) constructs that define:\n\n- Github Actions as OpenID Connect Identity Provider into AWS IAM\n- IAM Roles that can be assumed by Github Actions workflows\n\nThese constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.\n\n## Background information\n\n![github-aws-oidc](/assets/github-aws-oidc.svg \"Github OIDC with AWS\")\n\n- [GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) on Github Changelog Blog.\n- [Security hardening your deployments](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments) on Github Docs.\n- [Assuming a role with `aws-actions/configure-aws-credentials`](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n- Shout-out to [Richard H. Boyd](https://twitter.com/rchrdbyd) for helping me to debug Github OIDC setup with AWS IAM and his [Deploying to AWS with Github Actions](https://www.githubuniverse.com/2021/session/692586/deploying-to-aws-with-github-actions)-talk.\n- Shout-out to [Aidan W Steele](https://twitter.com/__steele) and his blog post [AWS federation comes to GitHub Actions](https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html) for being the original inspiration for this.\n\n<br/>\n\n## Getting started\n\n```shell\npnpm add -D aws-cdk-github-oidc\n```\n\n<br/>\n\n### OpenID Connect Identity Provider trust for AWS IAM\n\nTo create a new Github OIDC provider configuration into AWS IAM:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = new GithubActionsIdentityProvider(scope, \"GithubProvider\");\n```\n\nIn the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) and audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation).\n\n<br/>\n\n### Retrieving a reference to an existing Github OIDC provider configuration\n\nRemember, **there can be only one (Github OIDC provider per AWS Account)**, so to retrieve a reference to existing Github OIDC provider use `fromAccount` static method:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = GithubActionsIdentityProvider.fromAccount(\n  scope,\n  \"GithubProvider\"\n);\n```\n\n<br/>\n\n### Defining a role for Github Actions workflow to assume\n\n```ts\nimport { GithubActionsRole } from \"aws-cdk-github-oidc\";\n\nconst uploadRole = new GithubActionsRole(scope, \"UploadRole\", {\n  provider: provider, // reference into the OIDC provider\n  owner: \"octo-org\", // your repository owner (organization or user) name\n  repo: \"octo-repo\", // your repository name (without the owner name)\n  filter: \"ref:refs/tags/v*\", // JWT sub suffix filter, defaults to '*'\n});\n\n// use it like any other role, for example grant S3 bucket write access:\nmyBucket.grantWrite(uploadRole);\n```\n\nYou may pass in any `iam.RoleProps` into the construct's props, except `assumedBy` which will be defined by this construct (CDK will fail if you do):\n\n```ts\nconst deployRole = new GithubActionsRole(scope, \"DeployRole\", {\n  provider: provider,\n  owner: \"octo-org\",\n  repo: \"octo-repo\",\n  roleName: \"MyDeployRole\",\n  description: \"This role deploys stuff to AWS\",\n  maxSessionDuration: cdk.Duration.hours(2),\n});\n\n// You may also use various \"add*\" policy methods!\n// \"AdministratorAccess\" not really a good idea, just for an example here:\ndeployRole.addManagedPolicy(\n  iam.ManagedPolicy.fromAwsManagedPolicyName(\"AdministratorAccess\")\n);\n```\n\n<br/>\n\n#### Subject Filter\n\nBy default the value of `filter` property will be `'*'` which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on the [examples in Github Docs](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#configuring-the-oidc-trust-with-the-cloud); For example:\n\n| `filter` value                 | Descrition                               |\n| :----------------------------- | :--------------------------------------- |\n| `'ref:refs/tags/v*'`           | Allow only tags with prefix of `v`       |\n| `'ref:refs/heads/demo-branch'` | Allow only from branch `demo-branch`     |\n| `'pull_request'`               | Allow only from pull request             |\n| `'environment:Production'`     | Allow only from `Production` environment |\n\n> [!TIP]\n> Currently only one filter can be defined, a future update will introduce option to provide multiple filters (on the same repo).\n>\n> If you need:\n> - multiple filters on a same repo NOW or\n> - multiple repos to be able to assume the role\n>\n> see [@blimmer/cdk-github-oidc](https://github.com/blimmer/cdk-github-oidc) as an alternative!\n\n<br/>\n\n#### Immutable Subject\n\nGive both `ownerId` and `repoId` to form the trust policy with an [immutable subject](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims):\n\n```ts\nconst deployRole = new GithubActionsRole(scope, \"DeployRole\", {\n  provider: provider,\n  owner: \"octo-org\",\n  repo: \"octo-repo\",\n  ownerId: \"123456\", // your repository owner ID\n  repoId: \"456789\", // your repository ID\n  filter: \"ref:refs/tags/v*\",\n});\n```\n\nWhich results in a subject condition of `repo:octo-org@123456/octo-repo@456789:ref:refs/tags/v*` instead of `repo:octo-org/octo-repo:ref:refs/tags/v*`. Both properties must be given together, as CDK will fail if you only provide one of them.\n\n> [!IMPORTANT]\n> Ensure Github actually [issues an immutable subject](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims) for your repository **before** deploying a role which requires one, as otherwise `sts:AssumeRoleWithWebIdentity` will be denied.\n\n<br/>\n\n### Github Actions Workflow\n\nTo actually utilize this in your Github Actions workflow, use [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) to [assume a role](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n\n```yaml\njobs:\n  whoami:\n    name: Who Am I\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write # needed to interact with GitHub's OIDC Token endpoint.\n    steps:\n      - name: Configure AWS credentials\n        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1\n        with:\n          role-to-assume: arn:aws:iam::123456789012:role/MyUploadRole\n          #role-session-name: MySessionName # Optional\n          aws-region: us-east-1\n      - name: Get Caller Identity\n        run: |\n          aws sts get-caller-identity\n```\n\n<br/>\n\n\n## Migration Guide\n\n- [v2→v3](#v2v3)\n- [v3→v4](#v3v4)\n\n### v2→v3\n\n1. Install AWS CDK version [`v2.237.0`](https://github.com/aws/aws-cdk/releases/tag/v2.237.0) or newer required (due to support of [OIDC provider removal policy](https://github.com/aws/aws-cdk/commit/09383cbad28336441f0fb405c9d8a190135620dc)):\n\n    ```sh\n    pnpm add -D aws-cdk-lib@^2.237.0\n    ```\n\n2. Install `v3.1.0` (or newer v3 release) of this library:\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^3.1\n    ```\n\n3. No additional steps required, as the v3 major version does not introduce any breaking changes (just a lot of internal tooling changes).\n\n### v3→v4\n\n> [!CAUTION]\n> The following steps describe a _**no-downtime** migration path_.\n> It is the recommended approach, but somewhat _involved_: Hence some users may decide to use \"destroy + redeploy\" strategy instead, which causes downtime to authenticating from GitHub Actions to AWS using OIDC.\n\n1. Ensure you are running `v3.1.0` (or newer v3 release) of this library, see [v2→v3](#v2v3).\n\n2. Configure `RETAIN` removal policy for the provider:\n\n    ```diff\n    const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    });\n    ```\n\n3. Run `pnpm exec cdk diff`, which will show an output similar to:\n\n    ```sh\n    Resources\n    [~] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB\n    ├─ [~] DeletionPolicy\n    │   ├─ [-] Delete\n    │   └─ [+] Retain\n    └─ [~] UpdateReplacePolicy\n        ├─ [-] Delete\n        └─ [+] Retain\n    ```\n\n\n4. Deploy the changes `pnpm exec cdk deploy`\n\n5. Once the `RETAIN` removal policy has been successfully deployed, upgrade this library to `v4.2` (or newer v4 release):\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^4.2\n    ```\n\n6. Temporarily change from provider initializion to provider lookup:\n\n    ```diff\n    - const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    -  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    - });\n    + const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\"); // NOTICE the different construct ID\n    ```\n    ⚠️ **Notice the different construct ID** (in the example `GithubProviderReference` instead of ~~`GithubProvider`~~). This is required so that the CDK treats the GitHub OIDC provider lookup as a different \"thing\" and does not try to change the type of existing construct.\n\n7. Check `pnpm exec cdk diff` which should look similar to:\n    ```sh\n    Resources\n    [-] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB orphan\n    [-] AWS::IAM::Role Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Role CustomAWSCDKOpenIdConnectProviderCustomResourceProviderRole517FED65 destroy\n    [-] AWS::Lambda::Function Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Handler CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0 destroy\n    ```\n\n8. Deploy the changes with `pnpm exec cdk deploy`\n\n9. Once the deployment has succeeded, remove the provider lookup and replace it with the original provider initialization:\n\n    ```diff\n    - const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\");\n    + const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    + });\n    ```\n\n10. Copy the ARN of the existing OIDC provider, it will be in the format of:\n\n    ```\n    arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com # REPLACE with your account ID\n    ```\n\n11. Use [cdk import](https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-import.html):\n\n    ```sh\n    pnpm exec cdk import <YOUR_STACK_NAME>\n    ```\n\n    ... and when asked, input the provider ARN you copied in step 10:\n    ```sh\n    <YOUR_STACK_NAME>/GithubProvider/Resource (AWS::IAM::OIDCProvider): enter Arn (empty to skip)\n    ```\n\n12. You should be done now, but you may want to **perform manual verification** in addition to [drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html) and/or `cdk diff``\u001b to verify.\n\n\n\n"
   },
   "repository": {
     "type": "git",
@@ -9631,6 +9631,6 @@
       "symbolId": "src/iam-role-props:RoleProps"
     }
   },
-  "version": "5.1.1",
-  "fingerprint": "28xBlmoN/mLWRB+kH16dtnWQR+jYN8I1j9NCUbOMbPo="
+  "version": "5.2.0",
+  "fingerprint": "0T4nf2NSLDxTim3fU1fPAM08J6uH+hTWKQZdyeO2/Wg="
 }

package/README.md

@@ -114,6 +114,15 @@ By default the value of `filter` property will be `'*'` which means any workflow
 | `'pull_request'`               | Allow only from pull request             |
 | `'environment:Production'`     | Allow only from `Production` environment |
 
+> [!TIP]
+> Currently only one filter can be defined, a future update will introduce option to provide multiple filters (on the same repo).
+>
+> If you need:
+> - multiple filters on a same repo NOW or
+> - multiple repos to be able to assume the role
+> 
+> see [@blimmer/cdk-github-oidc](https://github.com/blimmer/cdk-github-oidc) as an alternative!
+
 <br/>
 
 #### Immutable Subject

package/lib/provider.js

@@ -48,7 +48,7 @@ const iam = __importStar(require("aws-cdk-lib/aws-iam"));
  * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
  */
 class GithubActionsIdentityProvider extends iam.OidcProviderNative {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "5.1.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "5.2.0" };
     static issuer = "token.actions.githubusercontent.com";
     /**
      * Retrieve a reference to existing Github OIDC provider in your AWS account.
@@ -64,8 +64,8 @@ class GithubActionsIdentityProvider extends iam.OidcProviderNative {
      * GithubActionsIdentityProvider.fromAccount(scope, "GithubProvider");
      */
     static fromAccount(scope, id) {
-        const accountId = cdk.Stack.of(scope).account;
-        const providerArn = `arn:aws:iam::${accountId}:oidc-provider/${GithubActionsIdentityProvider.issuer}`;
+        const { account, partition } = cdk.Stack.of(scope);
+        const providerArn = `arn:${partition}:iam::${account}:oidc-provider/${GithubActionsIdentityProvider.issuer}`;
         return iam.OidcProviderNative.fromOidcProviderArn(scope, id, providerArn);
     }
     /**
@@ -88,4 +88,4 @@ class GithubActionsIdentityProvider extends iam.OidcProviderNative {
     }
 }
 exports.GithubActionsIdentityProvider = GithubActionsIdentityProvider;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLGlEQUFtQztBQUNuQyx5REFBMkM7QUFpQjNDOzs7Ozs7Ozs7R0FTRztBQUNILE1BQWEsNkJBQ1gsU0FBUSxHQUFHLENBQUMsa0JBQWtCOztJQUd2QixNQUFNLENBQVUsTUFBTSxHQUFXLHFDQUFxQyxDQUFDO0lBRTlFOzs7Ozs7Ozs7Ozs7T0FZRztJQUNJLE1BQU0sQ0FBQyxXQUFXLENBQ3ZCLEtBQWdCLEVBQ2hCLEVBQVU7UUFFVixNQUFNLFNBQVMsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDOUMsTUFBTSxXQUFXLEdBQUcsZ0JBQWdCLFNBQVMsa0JBQWtCLDZCQUE2QixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3RHLE9BQU8sR0FBRyxDQUFDLGtCQUFrQixDQUFDLG1CQUFtQixDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUVEOzs7Ozs7Ozs7O09BVUc7SUFDSCxZQUNFLEtBQWdCLEVBQ2hCLEVBQVUsRUFDVixLQUEwQztRQUUxQyxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLEdBQUcsS0FBSztZQUNSLEdBQUcsRUFBRSxXQUFXLDZCQUE2QixDQUFDLE1BQU0sRUFBRTtZQUN0RCxTQUFTLEVBQUUsQ0FBQyxtQkFBbUIsQ0FBQztTQUNqQyxDQUFDLENBQUM7SUFDTCxDQUFDOztBQWpESCxzRUFrREMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBjZGsgZnJvbSBcImF3cy1jZGstbGliXCI7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1pYW1cIjtcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5cbmV4cG9ydCBpbnRlcmZhY2UgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXJQcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgcmVtb3ZhbCBwb2xpY3kgZm9yIHRoZSBwcm92aWRlci5cbiAgICpcbiAgICogQGRlZmF1bHQgY2RrLlJlbW92YWxQb2xpY3kuREVTVFJPWVxuICAgKi9cbiAgcmVhZG9ubHkgcmVtb3ZhbFBvbGljeT86IGNkay5SZW1vdmFsUG9saWN5O1xufVxuXG4vKipcbiAqIERlc2NyaWJlcyBhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIgZXh0ZW5kcyBpYW0uSU9pZGNQcm92aWRlciB7fVxuXG4vKipcbiAqIEdpdGh1YiBBY3Rpb25zIGFzIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyIGZvciBBV1MgSUFNLlxuICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICpcbiAqIFVzZSBgZnJvbUFjY291bnRgIHRvIHJldHJpZXZlIGEgcmVmZXJlbmNlIHRvIGV4aXN0aW5nIEdpdGh1YiBPSURDIHByb3ZpZGVyLlxuICpcbiAqIFVzZXMgdGhlIG5hdGl2ZSBDbG91ZEZvcm1hdGlvbiByZXNvdXJjZSBBV1M6OklBTTo6T0lEQ1Byb3ZpZGVyIChubyBMYW1iZGEgZnVuY3Rpb25zKS5cbiAqXG4gKiBAc2VlIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9jb25maWd1cmluZy1vcGVuaWQtY29ubmVjdC1pbi1hbWF6b24td2ViLXNlcnZpY2VzXG4gKi9cbmV4cG9ydCBjbGFzcyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlclxuICBleHRlbmRzIGlhbS5PaWRjUHJvdmlkZXJOYXRpdmVcbiAgaW1wbGVtZW50cyBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXJcbntcbiAgcHVibGljIHN0YXRpYyByZWFkb25seSBpc3N1ZXI6IHN0cmluZyA9IFwidG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb21cIjtcblxuICAvKipcbiAgICogUmV0cmlldmUgYSByZWZlcmVuY2UgdG8gZXhpc3RpbmcgR2l0aHViIE9JREMgcHJvdmlkZXIgaW4geW91ciBBV1MgYWNjb3VudC5cbiAgICogQW4gQVdTIGFjY291bnQgY2FuIG9ubHkgaGF2ZSBzaW5nbGUgR2l0aHViIE9JREMgcHJvdmlkZXIgY29uZmlndXJlZCBpbnRvIGl0LFxuICAgKiBzbyBpbnRlcm5hbGx5IHRoZSByZWZlcmVuY2UgaXMgbWFkZSBieSBjb25zdHJ1Y3RpbmcgdGhlIEFSTiBmcm9tIEFXU1xuICAgKiBBY2NvdW50IElEICYgR2l0aHViIGlzc3VlciBVUkwuXG4gICAqXG4gICAqIEBwYXJhbSBzY29wZSBDREsgU3RhY2sgb3IgQ29uc3RydWN0IHRvIHdoaWNoIHRoZSBwcm92aWRlciBpcyBhc3NpZ25lZCB0b1xuICAgKiBAcGFyYW0gaWQgQ0RLIENvbnN0cnVjdCBJRCBnaXZlbiB0byB0aGUgY29uc3RydWN0XG4gICAqIEByZXR1cm5zIGEgQ0RLIENvbnN0cnVjdCByZXByZXNlbnRpbmcgdGhlIEdpdGh1YiBPSURDIHByb3ZpZGVyXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqIEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmZyb21BY2NvdW50KHNjb3BlLCBcIkdpdGh1YlByb3ZpZGVyXCIpO1xuICAgKi9cbiAgcHVibGljIHN0YXRpYyBmcm9tQWNjb3VudChcbiAgICBzY29wZTogQ29uc3RydWN0LFxuICAgIGlkOiBzdHJpbmcsXG4gICk6IElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciB7XG4gICAgY29uc3QgYWNjb3VudElkID0gY2RrLlN0YWNrLm9mKHNjb3BlKS5hY2NvdW50O1xuICAgIGNvbnN0IHByb3ZpZGVyQXJuID0gYGFybjphd3M6aWFtOjoke2FjY291bnRJZH06b2lkYy1wcm92aWRlci8ke0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn1gO1xuICAgIHJldHVybiBpYW0uT2lkY1Byb3ZpZGVyTmF0aXZlLmZyb21PaWRjUHJvdmlkZXJBcm4oc2NvcGUsIGlkLCBwcm92aWRlckFybik7XG4gIH1cblxuICAvKipcbiAgICogRGVmaW5lIGEgbmV3IEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAgICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICAgKlxuICAgKiBAcGFyYW0gc2NvcGUgQ0RLIFN0YWNrIG9yIENvbnN0cnVjdCB0byB3aGljaCB0aGUgcHJvdmlkZXIgaXMgYXNzaWduZWQgdG9cbiAgICogQHBhcmFtIGlkIENESyBDb25zdHJ1Y3QgSUQgZ2l2ZW4gdG8gdGhlIGNvbnN0cnVjdFxuICAgKiBAcGFyYW0gcHJvcHMgb3B0aW9uYWwgcHJvcGVydGllcyBmb3IgdGhlIHByb3ZpZGVyXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqIG5ldyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcihzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKTtcbiAgICovXG4gIGNvbnN0cnVjdG9yKFxuICAgIHNjb3BlOiBDb25zdHJ1Y3QsXG4gICAgaWQ6IHN0cmluZyxcbiAgICBwcm9wcz86IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyUHJvcHMsXG4gICkge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLi4ucHJvcHMsXG4gICAgICB1cmw6IGBodHRwczovLyR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfWAsXG4gICAgICBjbGllbnRJZHM6IFtcInN0cy5hbWF6b25hd3MuY29tXCJdLFxuICAgIH0pO1xuICB9XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLGlEQUFtQztBQUNuQyx5REFBMkM7QUFpQjNDOzs7Ozs7Ozs7R0FTRztBQUNILE1BQWEsNkJBQ1gsU0FBUSxHQUFHLENBQUMsa0JBQWtCOztJQUd2QixNQUFNLENBQVUsTUFBTSxHQUFXLHFDQUFxQyxDQUFDO0lBRTlFOzs7Ozs7Ozs7Ozs7T0FZRztJQUNJLE1BQU0sQ0FBQyxXQUFXLENBQ3ZCLEtBQWdCLEVBQ2hCLEVBQVU7UUFFVixNQUFNLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ25ELE1BQU0sV0FBVyxHQUFHLE9BQU8sU0FBUyxTQUFTLE9BQU8sa0JBQWtCLDZCQUE2QixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzdHLE9BQU8sR0FBRyxDQUFDLGtCQUFrQixDQUFDLG1CQUFtQixDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUVEOzs7Ozs7Ozs7O09BVUc7SUFDSCxZQUNFLEtBQWdCLEVBQ2hCLEVBQVUsRUFDVixLQUEwQztRQUUxQyxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLEdBQUcsS0FBSztZQUNSLEdBQUcsRUFBRSxXQUFXLDZCQUE2QixDQUFDLE1BQU0sRUFBRTtZQUN0RCxTQUFTLEVBQUUsQ0FBQyxtQkFBbUIsQ0FBQztTQUNqQyxDQUFDLENBQUM7SUFDTCxDQUFDOztBQWpESCxzRUFrREMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBjZGsgZnJvbSBcImF3cy1jZGstbGliXCI7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1pYW1cIjtcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5cbmV4cG9ydCBpbnRlcmZhY2UgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXJQcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgcmVtb3ZhbCBwb2xpY3kgZm9yIHRoZSBwcm92aWRlci5cbiAgICpcbiAgICogQGRlZmF1bHQgY2RrLlJlbW92YWxQb2xpY3kuREVTVFJPWVxuICAgKi9cbiAgcmVhZG9ubHkgcmVtb3ZhbFBvbGljeT86IGNkay5SZW1vdmFsUG9saWN5O1xufVxuXG4vKipcbiAqIERlc2NyaWJlcyBhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIgZXh0ZW5kcyBpYW0uSU9pZGNQcm92aWRlciB7fVxuXG4vKipcbiAqIEdpdGh1YiBBY3Rpb25zIGFzIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyIGZvciBBV1MgSUFNLlxuICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICpcbiAqIFVzZSBgZnJvbUFjY291bnRgIHRvIHJldHJpZXZlIGEgcmVmZXJlbmNlIHRvIGV4aXN0aW5nIEdpdGh1YiBPSURDIHByb3ZpZGVyLlxuICpcbiAqIFVzZXMgdGhlIG5hdGl2ZSBDbG91ZEZvcm1hdGlvbiByZXNvdXJjZSBBV1M6OklBTTo6T0lEQ1Byb3ZpZGVyIChubyBMYW1iZGEgZnVuY3Rpb25zKS5cbiAqXG4gKiBAc2VlIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9jb25maWd1cmluZy1vcGVuaWQtY29ubmVjdC1pbi1hbWF6b24td2ViLXNlcnZpY2VzXG4gKi9cbmV4cG9ydCBjbGFzcyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlclxuICBleHRlbmRzIGlhbS5PaWRjUHJvdmlkZXJOYXRpdmVcbiAgaW1wbGVtZW50cyBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXJcbntcbiAgcHVibGljIHN0YXRpYyByZWFkb25seSBpc3N1ZXI6IHN0cmluZyA9IFwidG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb21cIjtcblxuICAvKipcbiAgICogUmV0cmlldmUgYSByZWZlcmVuY2UgdG8gZXhpc3RpbmcgR2l0aHViIE9JREMgcHJvdmlkZXIgaW4geW91ciBBV1MgYWNjb3VudC5cbiAgICogQW4gQVdTIGFjY291bnQgY2FuIG9ubHkgaGF2ZSBzaW5nbGUgR2l0aHViIE9JREMgcHJvdmlkZXIgY29uZmlndXJlZCBpbnRvIGl0LFxuICAgKiBzbyBpbnRlcm5hbGx5IHRoZSByZWZlcmVuY2UgaXMgbWFkZSBieSBjb25zdHJ1Y3RpbmcgdGhlIEFSTiBmcm9tIEFXU1xuICAgKiBBY2NvdW50IElEICYgR2l0aHViIGlzc3VlciBVUkwuXG4gICAqXG4gICAqIEBwYXJhbSBzY29wZSBDREsgU3RhY2sgb3IgQ29uc3RydWN0IHRvIHdoaWNoIHRoZSBwcm92aWRlciBpcyBhc3NpZ25lZCB0b1xuICAgKiBAcGFyYW0gaWQgQ0RLIENvbnN0cnVjdCBJRCBnaXZlbiB0byB0aGUgY29uc3RydWN0XG4gICAqIEByZXR1cm5zIGEgQ0RLIENvbnN0cnVjdCByZXByZXNlbnRpbmcgdGhlIEdpdGh1YiBPSURDIHByb3ZpZGVyXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqIEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmZyb21BY2NvdW50KHNjb3BlLCBcIkdpdGh1YlByb3ZpZGVyXCIpO1xuICAgKi9cbiAgcHVibGljIHN0YXRpYyBmcm9tQWNjb3VudChcbiAgICBzY29wZTogQ29uc3RydWN0LFxuICAgIGlkOiBzdHJpbmcsXG4gICk6IElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlciB7XG4gICAgY29uc3QgeyBhY2NvdW50LCBwYXJ0aXRpb24gfSA9IGNkay5TdGFjay5vZihzY29wZSk7XG4gICAgY29uc3QgcHJvdmlkZXJBcm4gPSBgYXJuOiR7cGFydGl0aW9ufTppYW06OiR7YWNjb3VudH06b2lkYy1wcm92aWRlci8ke0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn1gO1xuICAgIHJldHVybiBpYW0uT2lkY1Byb3ZpZGVyTmF0aXZlLmZyb21PaWRjUHJvdmlkZXJBcm4oc2NvcGUsIGlkLCBwcm92aWRlckFybik7XG4gIH1cblxuICAvKipcbiAgICogRGVmaW5lIGEgbmV3IEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlciBmb3IgQVdTIElBTS5cbiAgICogVGhlcmUgY2FuIGJlIG9ubHkgb25lIChwZXIgQVdTIEFjY291bnQpLlxuICAgKlxuICAgKiBAcGFyYW0gc2NvcGUgQ0RLIFN0YWNrIG9yIENvbnN0cnVjdCB0byB3aGljaCB0aGUgcHJvdmlkZXIgaXMgYXNzaWduZWQgdG9cbiAgICogQHBhcmFtIGlkIENESyBDb25zdHJ1Y3QgSUQgZ2l2ZW4gdG8gdGhlIGNvbnN0cnVjdFxuICAgKiBAcGFyYW0gcHJvcHMgb3B0aW9uYWwgcHJvcGVydGllcyBmb3IgdGhlIHByb3ZpZGVyXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqIG5ldyBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcihzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKTtcbiAgICovXG4gIGNvbnN0cnVjdG9yKFxuICAgIHNjb3BlOiBDb25zdHJ1Y3QsXG4gICAgaWQ6IHN0cmluZyxcbiAgICBwcm9wcz86IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyUHJvcHMsXG4gICkge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLi4ucHJvcHMsXG4gICAgICB1cmw6IGBodHRwczovLyR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfWAsXG4gICAgICBjbGllbnRJZHM6IFtcInN0cy5hbWF6b25hd3MuY29tXCJdLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/role.js

@@ -61,7 +61,7 @@ const provider_1 = require("./provider");
  * myBucket.grantWrite(uploadRole);
  */
 class GithubActionsRole extends iam.Role {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "5.1.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "5.2.0" };
     /**
      * Extracts props given for the created IAM Role Construct.
      * @param props for the GithubActionsRole

package/package.json

@@ -73,7 +73,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "5.1.1",
+  "version": "5.2.0",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [