01
Short-lived credentials
Exchange workload identity for temporary AWS credentials.
Component 02
OIDC
Let CI workloads access AWS using short-lived credentials.
Status
Available module
Deployment scope
AWS global service
What it deploys
The resources this component creates, and how they connect. Drag to pan, scroll to zoom.
Usage example
Inputs in, outputs out. Illustrative wiring, not a standalone deployment.
Define data.aws_iam_policy_document.deploy and restrict role trust to your intended repository and branch. Configure an AWS provider and verify issuer thumbprints. Configure provider requirements and credentials in your root module; check the documentation for all required inputs and version changes.
main.tf
module "oidc" {
source = "pomo-studio/oidc/aws"
version = "~> 2.0"
provider_url = "https://token.actions.githubusercontent.com"
client_id_list = ["sts.amazonaws.com"]
thumbprint_list = [
"6938fd4d98bab03faadb97b34396831e3780aea1",
"1c58a3a8518e8759bf075b76b750d4f2df264fcd",
]
roles = {
deploy = {
role_name = "my-app-deploy"
oidc_conditions = [{
test = "StringEquals"
variable = "token.actions.githubusercontent.com:sub"
values = ["repo:your-org/your-app:ref:refs/heads/main"]
}]
policy_json = data.aws_iam_policy_document.deploy.json
}
}
}Key inputs
- provider_url
- client_id_list
- thumbprint_list
- roles
Useful outputs
- provider_arn
- role_arns
- role_names
What you get
02
Scoped permissions
Keep each repository or workload limited to its intended resources.
03
GitHub-ready
Connect GitHub Actions to AWS without storing long-lived secrets.
Built with
- AWS IAM
- OIDC
- GitHub Actions
- Terraform