aws-lambda-api-tools 0.1.5 → 0.1.6

package/README.md

@@ -231,3 +231,15 @@ Contributions are welcome! Please feel free to submit a Pull Request.
 ## License
 
 MIT
+
+## GitHub Actions IAM Setup
+
+This package includes a utility to set up IAM OIDC authentication for GitHub Actions so that you can deploy to AWS from your GitHub Actions:
+
+```bash
+npx gh-oidc-iam --repo=owner/repo-name [--policy=PolicyName]
+```
+
+Options:
+- `--repo`: (Required) Your GitHub repository in the format `owner/repo-name`
+- `--policy`: (Optional) AWS managed policy name to attach to the role. Defaults to 'AdministratorAccess'

package/bin/bootstrap-iam.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+require('ts-node/register');
+require('./bootstrap-iam.ts'); 

package/bin/bootstrap-iam.ts

@@ -0,0 +1,56 @@
+#!/usr/bin/env ts-node
+import * as cdk from 'aws-cdk-lib';
+import * as iam from 'aws-cdk-lib/aws-iam';
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const repoArg = args.find(arg => arg.startsWith('--repo='));
+const policyArg = args.find(arg => arg.startsWith('--policy='));
+
+if (!repoArg) {
+  console.error('Error: --repo argument is required');
+  console.error('Usage: gh-oidc-iam --repo=owner/repo-name [--policy=PolicyName]');
+  console.error('Example: gh-oidc-iam --repo=myorg/my-repo --policy=AdministratorAccess');
+  process.exit(1);
+}
+
+const repoName = repoArg.split('=')[1];
+const policyName = policyArg ? policyArg.split('=')[1] : 'AdministratorAccess';
+
+const app = new cdk.App();
+
+class GithubActionsIamStack extends cdk.Stack {
+  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
+    super(scope, id, props);
+
+    const githubOidcProvider = new iam.OpenIdConnectProvider(this, 'GithubOidcProvider', {
+      url: 'https://token.actions.githubusercontent.com',
+      clientIds: ['sts.amazonaws.com'],
+    });
+
+    const deploymentRole = new iam.Role(this, 'GithubActionsRole', {
+      assumedBy: new iam.WebIdentityPrincipal(
+        githubOidcProvider.openIdConnectProviderArn,
+        {
+          StringEquals: {
+            'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
+          },
+          StringLike: {
+            'token.actions.githubusercontent.com:sub': `repo:${repoName}:*`,
+          },
+        }
+      ),
+      managedPolicies: [
+        iam.ManagedPolicy.fromAwsManagedPolicyName(policyName),
+      ],
+    });
+
+    new cdk.CfnOutput(this, 'RoleArn', {
+      value: deploymentRole.roleArn,
+      description: 'ARN of role to use in GitHub Actions',
+    });
+  }
+}
+
+new GithubActionsIamStack(app, 'GithubActionsIam');
+app.synth(); 

package/package.json

@@ -1,17 +1,20 @@
 {
   "name": "aws-lambda-api-tools",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "",
   "main": "dist/index.js",
   "bin": {
-    "generate-oas": "./bin/generate-swagger.js"
+    "generate-oas": "./bin/generate-swagger.js",
+    "gh-oidc-iam": "./bin/bootstrap-iam.js"
   },
   "types": "dist/index.d.ts",
   "scripts": {
     "build": "tsc",
     "bump-version": "npm run build && npm version patch -m 'Updated version to %s [skip ci]'",
     "test": "jest",
-    "generate-swagger": "node -r ts-node/register bin/generate-swagger.js"
+    "generate-swagger": "node -r ts-node/register bin/generate-swagger.js",
+    "---Github Actions Setup---": "",
+    "gh-oidc-iam": "cdk --app 'ts-node scripts/bootstrap-iam.ts' deploy GithubActionsIam --require-approval never"
   },
   "repository": {
     "type": "git",
@@ -33,7 +36,6 @@
     "nodemon": "^2.0.22",
     "prettier": "^2.8.8",
     "ts-jest": "^26.5.6",
-    "ts-node": "^9.1.1",
     "typescript": "^4.9.5"
   },
   "dependencies": {
@@ -46,13 +48,15 @@
     "@types/minimist": "^1.2.2",
     "@types/node-fetch": "^2.5.12",
     "atob": "^2.1.2",
+    "aws-cdk-lib": "^2.178.2",
     "axios": "^1.6.3",
     "joi": "^17.12.3",
     "joi-to-swagger": "6.2.0",
     "joi-to-typescript": "^4.11.0",
     "js-yaml": "^4.1.0",
     "lodash": "^4.17.21",
-    "minimist": "^1.2.6"
+    "minimist": "^1.2.6",
+    "ts-node": "^9.1.1"
   },
   "files": [
     "bin",