Skip to content

Conversation

FrontierPsychiatrist
Copy link

@FrontierPsychiatrist FrontierPsychiatrist commented Sep 24, 2025

Adds a module that creates an AWS IAM role that can be used from GitHub actions with configure-aws-credentials to trigger deployments using the deployment module (by putting objects into S3 or pushing an ECR image).


Should I add an example or maybe even extend an existing example? E.g., in examples/deployment/complete the idea would be to have this:

module "github_role" {
  source = "../../../modules/github-actions-role"

  github_repository = "moritzzimmer/terraform-aws-lambda"
  s3_prefixes       = ["${aws_s3_bucket.source.bucket}/${local.function_name}"]
}

and in examples/deployment/container-image:

module "github_role" {
  source = "../../../modules/github-actions-role"

  github_repository = "moritzzimmer/terraform-aws-lambda"
  ecr_repositories  = [aws_ecr_repository.this.name]
}

@FrontierPsychiatrist FrontierPsychiatrist changed the title feat: Module for IAM role to trigger deployments from GitHub actions feat: module for IAM role to trigger deployments from GitHub actions Sep 24, 2025
Adds a module that creates an AWS IAM role that can be used from
GitHub actions with [configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials)
to trigger deployments using the deployment module (by putting objects
into S3 or pushing an ECR image).
statement {
sid = "BucketLevelAccess"
effect = "Allow"
resources = [for prefix in var.s3_prefixes : "arn:aws:s3:::${split("/", prefix)[0]}"]

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This actually doesn't work as wanted when there's multiple / in the path...

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah wait, no, this explicitly only wants the bucket part without any paths, so it's correct

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant