GitHub Oidc and Latest Flagscript Cicd

.github/workflows/release.yml

@@ -0,0 +1,21 @@
+name: release
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    environment:
+      name: release #your environment name
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Semantic Release
+        uses: cycjimmy/semantic-release-action@v4
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}

.gitignore

@@ -267,3 +267,6 @@ $RECYCLE.BIN/
 *.lnk
 
 # End of https://www.toptal.com/developers/gitignore/api/osx,node,linux,windows,visualstudiocode,terraform
+
+# Custom
+.commit

.husky/pre-commit

@@ -0,0 +1,3 @@
+# echo "Generating pre-commit flag"
+# touch .commit
+terraform fmt -check

.releaserc

@@ -0,0 +1,34 @@
+{
+  "branches": [
+    "main"
+  ],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    [
+      "@semantic-release/changelog",
+      {
+        "changelogFile": "CHANGELOG.md"
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": [
+          "CHANGELOG.md"
+        ]
+      }
+    ],
+    [
+      "@semantic-release/github",
+      {
+        "assets": [
+          {
+            "path": "CHANGELOG.md",
+            "label": "CHANGELOG"
+          }
+        ]
+      }
+    ]
+  ]
+}

modules/account-setup/README.md

@@ -22,13 +22,16 @@ No modules.
 |------|------|
 | [aws_iam_account_alias.alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_alias) | resource |
 | [aws_iam_account_password_policy.password_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy) | resource |
+| [aws_iam_openid_connect_provider.github_openid_provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
 | [aws_s3_account_public_access_block.account_s3_public_access_block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_account_public_access_block) | resource |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_install_github_openid_profider"></a> [install\_github\_openid\_profider](#input\_install\_github\_openid\_profider) | Whether or not to install the github oidc provider. Currently for flagscript, this is only for accounts where github is pushing s3 content. | `bool` | `false` | no |
 | <a name="input_name"></a> [name](#input\_name) | The name for the aws account. | `string` | n/a | yes |
+| <a name="input_openid_provider_name"></a> [openid\_provider\_name](#input\_openid\_provider\_name) | Name of the github openid provider. | `string` | `"FlagscriptGitHibOpenIdProvider"` | no |
 
 ## Outputs
 

modules/account-setup/openid.tf

@@ -0,0 +1,15 @@
+resource "aws_iam_openid_connect_provider" "github_openid_provider" {
+  count = var.install_github_openid_profider ? 1 : 0
+  url   = "https://token.actions.githubusercontent.com"
+  client_id_list = [
+    "sts.amazonaws.com",
+  ]
+  thumbprint_list = ["D89E3BD43D5D909B47A18977AA9D5CE36CEE184C"]
+  tags = merge(
+    local.common_tags,
+    {
+      Name = var.openid_provider_name
+      "oidc-provider-type" : "github"
+    }
+  )
+}

modules/account-setup/variables.tf

@@ -7,3 +7,14 @@ variable "name" {
 
 # OPTIONAL PARAMETERS
 # These parameters have reasonable defaults.
+variable "install_github_openid_profider" {
+  default     = false
+  description = "Whether or not to install the github oidc provider. Currently for flagscript, this is only for accounts where github is pushing s3 content."
+  type        = bool
+}
+
+variable "openid_provider_name" {
+  default     = "FlagscriptGitHibOpenIdProvider"
+  description = "Name of the github openid provider."
+  type        = string
+}

package.json

@@ -0,0 +1,30 @@
+{
+  "name": "terraform-aws-flagscript-organization",
+  "description": "Flagscript structured organization and account setup modules adhering to reasonable aws standards.",
+  "main": "index.js",
+  "scripts": {
+    "prepare": "husky"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/flagscript/terraform-aws-flagscript-organization.git"
+  },
+  "keywords": [
+    "flagscript",
+    "aws",
+    "terraform",
+    "kms"
+  ],
+  "author": {
+    "name": "Greg Kaestle",
+    "email": "[email protected]"
+  },
+  "license": "ISC",
+  "bugs": {
+    "url": "https://github.com/flagscript/terraform-aws-flagscript-organization/issues"
+  },
+  "homepage": "https://github.com/flagscript/terraform-aws-flagscript-organization#readme",
+  "dependencies": {
+    "husky": "^9.1.5"
+  }
+}