01
Short-lived credentials
Exchange workload identity for temporary AWS credentials.
Pattern 02
OIDC
Full OIDC lifecycle on AWS with scoped IAM roles and no static credentials.
What you get
02
Scoped permissions
Keep each repository or workload limited to its intended resources.
03
GitHub-ready
Connect GitHub Actions to AWS without storing long-lived secrets.
Start here
Add the module to your configuration and customize only what you need.
main.tf
module "oidc" {
source = "pomo-studio/oidc/aws"
version = "~> 2.0"
provider_url = "https://token.actions.githubusercontent.com"
client_id_list = ["sts.amazonaws.com"]
thumbprint_list = [
"6938fd4d98bab03faadb97b34396831e3780aea1",
"1c58a3a8518e8759bf075b76b750d4f2df264fcd",
]
roles = {
deploy = {
role_name = "my-app-deploy"
oidc_conditions = []
policy_json = data.aws_iam_policy_document.deploy.json
}
}
}Key inputs
- provider_url
- client_id_list
- thumbprint_list
- roles
Useful outputs
- provider_arn
- role_arns
- role_names
Built with
- AWS IAM
- OIDC
- GitHub Actions
- Terraform