OpenId Connect allows you to make authenticated requests to platforms like AWS, can authenticate users and enable secure communication between platforms. AWS IAM OIDC identity providers can be created in an AWS account that uses OIDC to grant role based permissions to clients. Since IAM roles don’t have individual credentials like a user does, it is a more secure connection.

The GitHub OIDC role permits GitHub to request temporary security credentials for access to AWS and has a trust relationship attached to it that allows specified repositories within GitHub to have access to the AWS account. The same applies to the Terraform Cloud identity provider and role.

To create the Identity provider and role for GitHub Actions:

1. In AWS, navigate to IAM > Identity Providers > Add provider
2. Choose OpenID Connect
3. For Provider URL: https://token.actions.githubusercontent.com
4. For Audience: sts.amazonaws.com
5. Click Get thumbprint to verify the certificate then select Add provider
6. The provider will then be added, but now needs a role assigned to it
7. In the upper right hand corner, select Assign role
8. Choose Create a new role
9. The identity provider that was just created will already be selected
10. For Audience: sts.amazonaws.com
11. Next, choose AdministratorAccess for the permissions
12. Click Next until you are at the Review step
13. Name the role (github-actions-deployment-role) and then click Create role
14. Now navigate to this newly created role and click on the Trust relationships tab
15. Make sure the trust relationship looks something like the following which allows GitHub to access the specified AWS account:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<account-id>:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>/<REPOSITORY_NAME>:*"
                }
            }
        }
    ]
}

To create the Identity provider and role for Terraform Cloud:

• Follow the same procedure as the creation of the GitHub Actions identity provider and role, but substitute the following information:

For creating the identity provider:

1. For Provider URL: https://app.terraform.io
2. For Audience: aws.workload.identity

For creating the identity provider role:

1. For Audience: aws.workload.identity
2. Name the role (terraform-cloud-deployment-role) and then click Create role
3. Make sure the trust relationship looks something like the following which allows Terraform to access the specified AWS account:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<account-id>:oidc-provider/app.terraform.io"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "app.terraform.io:aud": "aws.workload.identity"
                },
                "StringLike": {
                    "app.terraform.io:sub": "organization:<TF_ORGANIZATION>:project:<PROJECT_NAME>:workspace:*:run_phase:*"
                }
            }
        }
    ]
}

Interested in more AWS related services? Check out this article on how to automate deployments to AWS ECS with GitHub Actions.