main.tf

locals {
  legacy_repository_refs = [
    for repo in var.repository_names :
    "repo:${var.github_username}/${repo}:*"
  ]

  immutable_repository_refs = (
    var.github_owner_id != null
    ? [
      for repo in var.repository_names :
      "repo:${var.github_username}@${var.github_owner_id}/${repo}@${var.github_repository_ids[repo]}:*"
      if contains(keys(var.github_repository_ids), repo)
    ]
    : []
  )

  repository_ref_list = concat(
    local.legacy_repository_refs,
    local.immutable_repository_refs
  )
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.aws_account_id}:oidc-provider/token.actions.githubusercontent.com"]
    }

    actions = ["sts:AssumeRoleWithWebIdentity"]

    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values   = local.repository_ref_list
    }

    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }
  }
}

resource "aws_iam_openid_connect_provider" "github_oidc" {
  url = "https://token.actions.githubusercontent.com"

  client_id_list = [
    "sts.amazonaws.com",
  ]
  thumbprint_list = [
    "6938fd4d98bab03faadb97b34396831e3780aea1"
  ]
}

resource "aws_iam_role" "github_action" {
  name               = var.role_name
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

resource "aws_iam_role_policy_attachment" "admin" {
  role       = aws_iam_role.github_action.name
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}