--- type: "article" title: "Configuring CDK with GitHub Actions and OIDC" summary: "OpenID Connect (OIDC) allows your GitHub Actions workflows to access resources in Amazon Web Services (AWS), without needing to store the AWS credentials as long-lived GitHub secrets." newsletter: "Engineering Strategy" newsletter_handle: "engineeringstrategy" newsletter_url: "https://usecommune.com/n/engineeringstrategy" author: "Aleix Morgadas (@aleixmorgadas)" published: "2023-07-29T12:40:16.648Z" canonical_url: "https://usecommune.com/n/engineeringstrategy/a/configuring-cdk-with-github-actions-and-oidc" markdown_url: "https://usecommune.com/n/engineeringstrategy/a/configuring-cdk-with-github-actions-and-oidc.md" chat_url: "https://usecommune.com/n/engineeringstrategy/a/configuring-cdk-with-github-actions-and-oidc/chat" body_source: "imported" likes: 0 replies: 0 body_words: 533 --- # Configuring CDK with GitHub Actions and OIDC OpenID Connect (OIDC) allows your GitHub Actions workflows to access resources in Amazon Web Services (AWS), without needing to store the AWS credentials as long-lived GitHub secrets. [AWS CDK](https://aws.amazon.com/cdk/) helps you define your cloud application resources using familiar languages such as python, node, and more. If you setup from the beginning using this guideline, you will have secured your connection between GitHub Actions and AWS without needing to expose the AWS credentials as GitHub Secrets. ## Boostrap your infrastructure CDK provides a way to boostrap all the necessary resources to start deploying using CDK in your aws account. The next command assumes you have configured in your local machine the aws credentials and region configuration. If not, please refer to the [official guideline](https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html) on how to specify those credentials. ``` npx cdk bootstrap ``` After some minutes, you will see in your IAM > Roles a set of roles created by CDK to manage your infrastructure. We will use them on the next steps to allow GitHub to deploy CloudFormation Stack changes assuming those roles. [![](https://substack-post-media.s3.amazonaws.com/public/images/7689af70-ec6b-4c1c-8aed-e179c8203448_1600x470.png)](https://substackcdn.com/image/fetch/$s_!6GEy!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F7689af70-ec6b-4c1c-8aed-e179c8203448_1600x470.png) ## Create a new role for github-actions to assume I found more convinient to create a dedicated role for GitHub Actions to assume with the necessary trust relationship and permissions. Go to IAM > Roles and Create Role. We will choose `Custom trust policy` [![](https://substack-post-media.s3.amazonaws.com/public/images/f9c312fa-5ca9-4dcf-946b-15157c76e39e_1920x968.png)](https://substackcdn.com/image/fetch/$s_!-BC_!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Ff9c312fa-5ca9-4dcf-946b-15157c76e39e_1920x968.png) ### Trust relationship We will copy the next code replacing the values of: - \ with your account id from AWS. - \/\ with the repositories that should be able to change AWS resources. ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "RoleForGitHub", "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam:::oidc-provider/token.actions.githubusercontent.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com", "token.actions.githubusercontent.com:sub": [ "repo:/:ref:refs/heads/main", "repo:/:ref:refs/heads/main" ] } } } ] } ``` ### Policies Next, it will ask us for the policies to add. We will click to the `Create new policy` button, and we will use the `JSON` format. [![](https://substack-post-media.s3.amazonaws.com/public/images/6bb28bb0-bcf5-42fa-b73d-410b5438c64b_1920x968.png)](https://substackcdn.com/image/fetch/$s_!-cbP!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F6bb28bb0-bcf5-42fa-b73d-410b5438c64b_1920x968.png) We will copy pase the next code replacing: - \ by your AWS account number - \ with the region you plan to deploy your resources. The same that cdk created during the \``cdk boostrap`\` step. Copy paste those arn resources. ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "assumerolecdk", "Effect": "Allow", "Action": [ "sts:AssumeRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam:::role/cdk-hnb659fds-lookup-role--", "arn:aws:iam:::role/cdk-hnb659fds-deploy-role--", "arn:aws:iam:::role/cdk-hnb659fds-file-publishing-role--", "arn:aws:iam:::role/cdk-hnb659fds-image-publishing-role--" ] } ] } ``` ## Verify that your role looks like [![](https://substack-post-media.s3.amazonaws.com/public/images/0435a72b-a5cb-416e-9b84-c6019ab6e658_1600x896.png)](https://substackcdn.com/image/fetch/$s_!kp3h!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F0435a72b-a5cb-416e-9b84-c6019ab6e658_1600x896.png) [![](https://substack-post-media.s3.amazonaws.com/public/images/7ece93ec-6fc9-487e-a616-1d3736ebbf65_1587x875.png)](https://substackcdn.com/image/fetch/$s_!DOpX!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F7ece93ec-6fc9-487e-a616-1d3736ebbf65_1587x875.png) ## GitHub Action Now, you can tell GitHub Action to deploy the resources assuming the new role replacing the \ and \ with your particular case. The next code assumes you are using CDK with node, if you use CDK with python, you need to adapt the code to setup python. ``` name: Deployment on: push: branches: [ "main" ] workflow_dispatch: jobs: build: runs-on: ubuntu-latest permissions: id-token: write contents: read steps: - uses: actions/checkout@v3 - name: Set up node 18 uses: actions/setup-node@v3 with: node-version: 18 cache: npm - name: npm install run: npm install - name: npm tests run: npm tests - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 with: aws-region: role-to-assume: arn:aws:iam:::role/github-role role-session-name: deployment-session - name: cdk synth run: npx --yes cdk synth - name: cdk deploy run: npx --yes cdk deploy --require-approval never ``` *** ## Discussion No replies yet.