GitHub Actions with AWS IAM via OIDC

Running the project (assuming setup is already done)

# deploy the stack
AWS_PROFILE=cloud-course pulumi up

A repo will be created with a .github/workflows/aws-oidc-demo.yml already present:

You can trigger the workflow manually:

And see that the the github repo is able to successfully assume and use the IAM role!

Architecture

The OIDC connector

Pulumi setup

brew install pulumi uv gh awscli

# configure the state to be stored locally (unless you use pulumi cloud)
pulumi login --local

# login to github, the pulumi github provider can use this;
# easier than creating a P.A.T. and setting is as a config / env var
gh auth login

# log into AWS
aws sso login --profile cloud-course

This project makes use of the pulumi-github provider.

From the docs:

GitHub CLI The GitHub provider taps into GitHub CLI authentication, where it picks up the token issued by gh auth login command. It is possible to specify the path to the gh executable in the GH_PATH environment variable, which is useful for when the GitHub Pulumi provider can not properly determine its the path to GitHub CLI such as in the cygwin terminal.

How did we bootstrap this project?

Starting from an empty dir called github-ci-aws-oidc:

pulumi new aws-python # selected stack_name=dev, toolchain=uv
uv add pulumi-github

Then wrote the contents of __main__.py.