AWS GitHub OIDC CDK Project

This CDK TypeScript project creates GitHub Actions OIDC integration for secure CI/CD deployments to AWS without storing long-lived credentials.

Overview

The project sets up:

• OpenID Connect Provider for GitHub Actions
• IAM Roles with secure trust policies for repository-specific access
• CDK deployment permissions for GitHub Actions workflows

Key Features

• 🔐 Secure Authentication: Uses OIDC instead of long-lived AWS credentials
• 🎯 Repository-specific Access: IAM conditions restrict access to specific GitHub repositories
• 🚀 CDK Ready: Pre-configured with CDK deployment permissions
• ✅ Well Tested: Comprehensive unit tests with fine-grained assertions

Architecture

• Main Entry: src/app.ts - defines the CDK stack and OIDC provider
• Core Construct: src/constructs/actions-oidc.ts - reusable OIDC role construct
• Repository Managers: src/oidc-manager.ts, src/startup-factory.ts - specific repository configurations

Development Commands

Building and Testing

# Install dependencies
pnpm install

# Compile TypeScript
pnpm run build

# Watch for changes
pnpm run watch

# Run unit tests
pnpm test

# Run linting
pnpm lint

# Format code
pnpm run format

CDK Operations

# Deploy to AWS (requires AWS credentials)
npx cdk deploy

# Compare with deployed stack
npx cdk diff

# Generate CloudFormation template
npx cdk synth

Testing

This project includes comprehensive CDK unit tests using Jest and the AWS CDK Testing Library. Tests validate:

• OIDC provider configuration with correct GitHub thumbprints
• IAM role trust policies and permissions
• Resource creation and properties

See test/README.md for detailed testing documentation.

Security Configuration

The OIDC provider uses GitHub's SSL certificate thumbprints for secure authentication:

• Primary: 6938fd4d98bab03faadb97b34396831e3780aea1
• Secondary: 1c58a3a8518e8759bf075b76b750d4f2df264fcd

Trust conditions restrict access to: repo:${userName}/${repoName}:*

Package Manager

This project uses pnpm as the primary package manager for faster, more efficient dependency management.

Contributing

1. Make changes to the code
2. Run tests: pnpm test
3. Run linting: pnpm lint
4. Build the project: pnpm run build
5. Deploy and test: npx cdk deploy