IAM Role to Access AWS accounts for Github Actions

Wed, 01 Jan 2025 14:43:37 +0100

I have always wondered the best course of action when giving access to a repo from Github to access and deploy resources to AWS. More often than not, what I see is using credentials in the from of AWS Secret and Access keys curated from a user on AWS IAM. I believein exploring everything through Infrastructure as Code (IAC).

This blog post would be exploring using IAM Roles and setting it up through cloudformation, and granting access to the role and implementing the role in Github Actions. I would be leveraging AWS IAM Idenity Provider, specifically the OpenID Connect (OIDC).
Basically, there are 3 parties involved, an OIDC provider, a user and an application. If a user goes to an application and instead of filling the form, using a username and a password, they could decided to sign up using an OIDC provider (Signup with Google as an example). In that case, Google handles the authentication process also optaining the consent from the user to provide the specific information needed by the application. For more on OpenID Connect, read this blog from Microsoft here.

Openid on My Blog

IAM Role to Access AWS accounts for Github Actions