bitbucket-oidc-template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Bitbucket OIDC configuration for communication between Bitbucket and AWS.

Parameters:
  WorkspaceName:
    Type: String
    Default: pjv93
    Description: "Bitbucket workspace name (e.g., pjv93)."

  RepositoryUUID:
    Type: String 
    Default: "*"
    Description: "Bitbucket repository UUID (e.g., {123e4567-e89b-12d3-a456-426614174000}) or * for all repositories."

  Audience:
    Type: String
    Description: "The audience (aud) retrieved from Bitbucket repository settings."

  BucketName:
    Type: String
    Default: iampjv.co
    Description: "S3 bucket name (e.g., iampjv.co)."

  IAMRoleName:
    Type: String
    Default: Bitbucket_OIDC_Role
    Description: "IAM role name for Bitbucket OIDC (default: Bitbucket_OIDC_Role)."

Resources:
  # OIDC Provider
  BitbucketOidcProvider:
    Type: AWS::IAM::OIDCProvider
    Properties:
      ClientIdList:
        - !Ref Audience
      ThumbprintList:
        - a031c46782e6e6c661cd4bd10397f7fdc7df0afe
      Url: !Sub "https://api.bitbucket.org/2.0/workspaces/${WorkspaceName}/pipelines-config/identity/oidc"

  # IAM Role
  BitbucketOidcRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref IAMRoleName
      AssumeRolePolicyDocument: !Sub
        - |
          {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Principal": {
                  "Federated": "${IamOidcProviderArn}"
                },
                "Action": "sts:AssumeRoleWithWebIdentity",
                "Condition": {
                  "StringEquals": {
                    "${OidcProviderEndpoint}:aud": "${Audience}"
                  },
                  "StringLike": {
                    "${OidcProviderEndpoint}:sub": "${RepositoryUUID}:*"
                  }
                }
              }
            ]
          }
        - {
            "IamOidcProviderArn": !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/api.bitbucket.org/2.0/workspaces/${WorkspaceName}/pipelines-config/identity/oidc",
            "OidcProviderEndpoint": !Sub "api.bitbucket.org/2.0/workspaces/${WorkspaceName}/pipelines-config/identity/oidc",
            "Audience": !Ref Audience,
            "RepositoryUUID": !Ref RepositoryUUID
          }
      Policies:
        - PolicyName: BitbucketOIDCPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: S3Access
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:DeleteObject
                Resource:
                  - !Sub "arn:aws:s3:::${BucketName}/*"
              - Sid: CloudWatchLogsAccess
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: "*"

Outputs:
  RoleArn:
    Description: "The ARN of the IAM Role for Bitbucket OIDC."
    Value: !GetAtt BitbucketOidcRole.Arn
    Export:
      Name: BitbucketOidcRoleArn