fix: GitHub Actions ID Token permissions for AWS IAM Role access (#85)

vincenthsh · Mar 15, 2023 · f23d16d · f23d16d
1 parent 6f37ee0
commit f23d16d
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 0 deletions.
diff --git a/templates/templates/.github/workflows/fogg_ci.yml.tmpl b/templates/templates/.github/workflows/fogg_ci.yml.tmpl
@@ -10,6 +10,12 @@ concurrency:
 jobs:
   fogg-apply:
     runs-on: ubuntu-latest
+    {{- if not (eq (len $githubActionsCI.DefaultAWSIAMRoleName) 0) }}
+    permissions:
+      # required for GH Actions -> OIDC -> AWS
+      id-token: write
+      # required to push fixes back to repo
+      contents: write{{ end }}
     steps:
       - uses: actions/checkout@v3
         with:

diff --git a/testdata/github_actions_with_iam_role/.github/workflows/fogg_ci.yml b/testdata/github_actions_with_iam_role/.github/workflows/fogg_ci.yml
diff --git a/testdata/v2_full_yaml/.github/workflows/fogg_ci.yml b/testdata/v2_full_yaml/.github/workflows/fogg_ci.yml