Skip to content

Commit 6047a42

Browse files
grolstonkellertk
grolston
and
kellertk
authored
feat: examples (#553)
* init examples * restructure * example versions Co-authored-by: Tom Keller <[email protected]>
1 parent aeb090a commit 6047a42

File tree

8 files changed

+360
-0
lines changed

8 files changed

+360
-0
lines changed

‎examples/README.md

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Examples
2+
3+
## [federated-setup](./federated-setup/README.md)
4+
5+
The directory contains templates for setting up the `configure-aws-credentials` federation between your GitHub Organization/repository and your AWS account.
6+
7+
## [cfn-deploy-example](./cfn-deploy-example/README.md)
8+
9+
Repository example uses aws-action `configure-aws-credentials` with OIDC federation template [github-actions-oidc-federation-and-role](./github-actions-oidc-federation-and-role.yml). Example demonstrates a repository that deploys AWS CloudFormation template using cfn-deploy GitHub Action.

‎examples/cfn-deploy-example/.github/workflows/compliance.yml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: 'compliance'
2+
## run ci testing on all push events
3+
on: [push]
4+
jobs:
5+
## Guard rule set
6+
sast-guard:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@v3
10+
- uses: grolston/guard-action@main
11+
with:
12+
data_directory: './cloudformation/' ## change to your template directory
13+
rule_set: 'FedRAMP-Moderate'
14+
show_summary: 'all'
15+
output_format: 'single-line-summary'

‎examples/cfn-deploy-example/.github/workflows/deploy.yml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
name: deploy
3+
on:
4+
push:
5+
branches:
6+
- main
7+
env:
8+
AWS_DEFAULT_REGION: us-east-1
9+
AWS_DEFAULT_OUTPUT: json
10+
11+
jobs:
12+
deploy-cfn:
13+
name: deploy
14+
runs-on: ubuntu-latest
15+
# These permissions are needed to interact with GitHub’s OIDC Token endpoint.
16+
permissions:
17+
id-token: write
18+
contents: read
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v3
22+
- name: Configure AWS Credentials
23+
uses: aws-actions/configure-aws-credentials@v1-node16
24+
with:
25+
aws-region: us-east-1
26+
## the following creates an ARN based on the values entered into github secrets
27+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_DEPLOY_ROLE }}
28+
role-session-name: myGitHubActions
29+
- name: Deploy EC2 Bastion
30+
uses: aws-actions/[email protected]
31+
with:
32+
name: myEC2bastion
33+
## change to path to template in your github repo
34+
template: cloudformation/ec2-bastion.yml
35+
capabilities: CAPABILITY_IAM, CAPABILITY_NAMED_IAM
36+
no-fail-on-empty-changeset: "1"
37+
## parameter set in github secrets
38+
parameter-overrides: "pVpc=${{ secrets.VPC_ID }},pSubnet=${{ secrets.SUBNET_ID }}"

‎examples/cfn-deploy-example/README.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# cfn-deploy example
2+
3+
Example uses aws-action `configure-aws-credentials` with OIDC federation. Prior to using this example project, the user needs to deploy the [github-actions-oidc-federation-and-role](../federated-setup/github-actions-oidc-federation-and-role.yml) template in the AWS account they want to deploy the CloudFormation template into. Specify the GitHub Organization name, repository name, and the specific branch you want to deploy on.
4+
5+
Within the [github/workflows](./.github/workflows/) directory there is a [compliance.yml](./.github/workflows/compliance.yml) and a [deploy.yml](./.github/workflows/deploy.yml). The deploy.yml file leverages the aws-action `configure-aws-credentials` and accesses GitHub Action Secrets for some of the variables. The compliance.yml runs static application security testing using cfn-guard.
6+
7+
To use the example you will need to set the following GitHub Action Secrets:
8+
9+
| Secret Key | Used With | Description |
10+
| --------- | -------- | -----------|
11+
| AWS_ACCOUNT_ID | configure-aws-credentials | The AWS account ID |
12+
| AWS_DEPLOY_ROLE | configure-aws-credentials | The name of the IAM role |
13+
| VPC_ID | aws-cloudformation-github-deploy | VPC ID the EC2 Bastion is deployed to |
14+
| SUBNET_ID | aws-cloudformation-github-deploy | Subnet ID the EC2 Bastion is deployed to |

‎examples/cfn-deploy-example/ec2-bastion.yml

+150
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
---
2+
AWSTemplateFormatVersion: "2010-09-09"
3+
Description: EC2 bastion for latest AWS Linux 2 EC2 deployment
4+
Metadata:
5+
AWS::CloudFormation::Interface:
6+
ParameterGroups:
7+
- Label:
8+
default: "EC2 Configuration"
9+
Parameters:
10+
- pTagNameValue
11+
- pOperatingSystem
12+
- pInstanceType
13+
- pVolumeSize
14+
- pEbsDeleteOnTermination
15+
- Label:
16+
default: "Network Configuration"
17+
Parameters:
18+
- pVpc
19+
- pSubnet
20+
ParameterLabels:
21+
pOperatingSystem:
22+
default: "Operating System"
23+
pInstanceType:
24+
default: "Instance Type"
25+
pTagNameValue:
26+
default: "EC2 Name"
27+
pVolumeSize:
28+
default: "Volume Size"
29+
pEbsDeleteOnTermination:
30+
default: "Delete EBS Volume on Termination"
31+
pSubnet:
32+
default: "Subnet"
33+
pVpc:
34+
default: "VPC"
35+
Parameters:
36+
pSubnet:
37+
Description: The subnet to launch the instance in to. It must be part of the VPC chosen above.
38+
Type: AWS::EC2::Subnet::Id
39+
pVpc:
40+
Description: The VPC to launch the EC2 instance in to.
41+
Type: AWS::EC2::VPC::Id
42+
pOperatingSystem:
43+
Type: "AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>"
44+
Default: "/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-ebs"
45+
pInstanceType:
46+
Description: Desired Instance Size
47+
Type: String
48+
Default: t3.small
49+
AllowedValues:
50+
- t3.small
51+
- t3.medium
52+
- t3.nano
53+
pTagNameValue:
54+
Description: "Required: Enter the tag name you'd like applied to the instance. Tag Name gives the name to the EC2 instance."
55+
Type: String
56+
MinLength: 1
57+
Default: "myBastion"
58+
pVolumeSize:
59+
Description:
60+
Enter the number of GBs you want your volume to be. The minimum value
61+
is 8 GBs
62+
Type: Number
63+
Default: 50
64+
MinValue: 8
65+
pEbsDeleteOnTermination:
66+
Description: "Specify if the EBS volume should be deleted if EC2 is deleted."
67+
Type: String
68+
Default: true
69+
AllowedValues:
70+
- true
71+
- false
72+
Rules:
73+
SubnetInVPC:
74+
Assertions:
75+
- Assert: !EachMemberIn
76+
- !ValueOfAll
77+
- AWS::EC2::Subnet::Id
78+
- VpcId
79+
- !RefAll "AWS::EC2::VPC::Id"
80+
AssertDescription: All subnets must in the VPC
81+
Resources:
82+
rSecurityGroupDefault:
83+
Type: AWS::EC2::SecurityGroup
84+
Properties:
85+
GroupDescription: !Sub "Default SG for SC Product ${pTagNameValue} "
86+
VpcId: !Ref pVpc
87+
SecurityGroupEgress:
88+
- Description: Outbound unrestricted traffic
89+
IpProtocol: "-1"
90+
CidrIp: 0.0.0.0/0
91+
Tags:
92+
- Key: Name
93+
Value: !Ref pTagNameValue
94+
rLinuxEc2:
95+
Type: AWS::EC2::Instance
96+
Metadata:
97+
guard:
98+
SuppressedRules:
99+
- 'EC2_INSTANCE_DETAILED_MONITORING_ENABLED'
100+
Properties:
101+
ImageId: !Ref pOperatingSystem
102+
IamInstanceProfile: !Ref rec2InstanceProfile
103+
Monitoring: false
104+
InstanceType: !Ref pInstanceType
105+
EbsOptimized: true
106+
SourceDestCheck: true
107+
SubnetId: !Ref pSubnet
108+
SecurityGroupIds:
109+
- !Ref rSecurityGroupDefault
110+
BlockDeviceMappings:
111+
- DeviceName: "/dev/xvda"
112+
Ebs:
113+
VolumeSize: !Ref pVolumeSize
114+
DeleteOnTermination: !Ref pEbsDeleteOnTermination
115+
Tags:
116+
- Key: Name
117+
Value: !Ref pTagNameValue
118+
UserData:
119+
Fn::Base64:
120+
yum update -y
121+
## Instance Profiles
122+
## EC2 IAM Roles
123+
rEc2Role:
124+
Type: AWS::IAM::Role
125+
Properties:
126+
RoleName: !Sub "ec2-role-${AWS::StackName}"
127+
AssumeRolePolicyDocument:
128+
Statement:
129+
- Effect: Allow
130+
Principal:
131+
Service: [ec2.amazonaws.com]
132+
Action: ['sts:AssumeRole']
133+
Path: /
134+
ManagedPolicyArns:
135+
- !Sub 'arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore'
136+
- !Sub 'arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy'
137+
rec2InstanceProfile:
138+
Type: AWS::IAM::InstanceProfile
139+
Properties:
140+
InstanceProfileName: !Sub "ec2-profile-${AWS::StackName}"
141+
Path: /
142+
Roles:
143+
- !Ref rEc2Role
144+
Outputs:
145+
oLinuxEc2InstanceId:
146+
Description: Resource ID of the newly created EC2 instance
147+
Value: !Ref rLinuxEc2
148+
oLinuxEc2PrivateIP:
149+
Description: Private IP Address for EC2
150+
Value: !GetAtt rLinuxEc2.PrivateIp

‎examples/federated-setup/README.md

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# federated-setup
2+
3+
## [github-action-oidc-federation](./github-actions-odic-federation.yml)
4+
5+
Setup of the OIDC federation between your GitHub Organization/repository and your AWS account.
6+
7+
## [github-actions-oidc-federation-and-role](./github-actions-oidc-federation-and-role.yml)
8+
9+
Setup of the OIDC federation between your GitHub Organization/repository and your AWS account along with a role that only executes on specific branch.

‎examples/federated-setup/github-actions-odic-federation.yml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
AWSTemplateFormatVersion: "2010-09-09"
3+
Description: Github Actions configuration - OIDC IAM IdP Federation
4+
5+
Parameters:
6+
7+
GitHubOrganization:
8+
Type: String
9+
Description: This is the root organization or personal account where repos are stored (Case Sensitive)
10+
Default: ""
11+
12+
RepositoryName:
13+
Type: String
14+
Description: The repo(s) these roles will have access to. (Use * for all org or personal repos)
15+
Default: "*"
16+
17+
RoleName:
18+
Type: String
19+
Description: Name the Role
20+
Default: ""
21+
22+
23+
Resources:
24+
25+
IdpGitHubOidc:
26+
Type: AWS::IAM::OIDCProvider
27+
Properties:
28+
Url: https://token.actions.githubusercontent.com
29+
ClientIdList:
30+
- sts.amazonaws.com
31+
- !Sub https://github.com/${GitHubOrganization}/${RepositoryName}
32+
ThumbprintList:
33+
- 6938fd4d98bab03faadb97b34396831e3780aea1
34+
Tags:
35+
- Key: Name
36+
Value: !Sub ${RoleName}-OIDC-Provider
37+
38+
39+
Outputs:
40+
41+
IdpGitHubOidc:
42+
Description: "ARN of Github OIDC Provider"
43+
Value: !GetAtt IdpGitHubOidc.Arn

‎examples/federated-setup/github-actions-oidc-federation-and-role.yml

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
---
2+
AWSTemplateFormatVersion: "2010-09-09"
3+
Description: Github Actions configuration - OIDC IAM IdP and associated role CI/CD
4+
5+
Parameters:
6+
7+
GitHubOrganization:
8+
Type: String
9+
Description: This is the root organization or personal account where repos are stored (Case Sensitive)
10+
11+
RepositoryName:
12+
Type: String
13+
Description: The repo(s) these roles will have access to. (Use * for all org or personal repos)
14+
Default: "*"
15+
16+
BranchName:
17+
Type: String
18+
Description: Name of the git branch to to trust. (Use * for all branches)
19+
Default: "*"
20+
21+
RoleName:
22+
Type: String
23+
Description: Name the Role
24+
25+
UseExistingProvider:
26+
Type: String
27+
Description: "Only one GitHub Provider can exists. Choose yes if one is already present in account"
28+
Default: "no"
29+
AllowedValues:
30+
- "yes"
31+
- "no"
32+
33+
Conditions:
34+
35+
CreateProvider: !Equals ["no", !Ref UseExistingProvider]
36+
37+
Resources:
38+
39+
IdpGitHubOidc:
40+
Type: AWS::IAM::OIDCProvider
41+
Condition: CreateProvider
42+
Properties:
43+
Url: https://token.actions.githubusercontent.com
44+
ClientIdList:
45+
- sts.amazonaws.com
46+
- !Sub https://github.com/${GitHubOrganization}/${RepositoryName}
47+
ThumbprintList:
48+
- 6938fd4d98bab03faadb97b34396831e3780aea1
49+
Tags:
50+
- Key: Name
51+
Value: !Sub ${RoleName}-OIDC-Provider
52+
53+
RoleGithubActions:
54+
Type: AWS::IAM::Role
55+
Properties:
56+
RoleName: !Ref RoleName
57+
AssumeRolePolicyDocument:
58+
Statement:
59+
- Effect: Allow
60+
Action: sts:AssumeRoleWithWebIdentity
61+
Principal:
62+
Federated: !If
63+
- CreateProvider
64+
- !Ref IdpGitHubOidc
65+
- !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com
66+
Condition:
67+
StringLike:
68+
token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrganization}/${RepositoryName}:ref:refs/heads/${BranchName}
69+
ManagedPolicyArns:
70+
## edit the managed policy to give least privileges
71+
- !Sub arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess
72+
73+
Outputs:
74+
75+
IdpGitHubOidc:
76+
Condition: CreateProvider
77+
Description: "ARN of Github OIDC Provider"
78+
Value: !GetAtt IdpGitHubOidc.Arn
79+
80+
RoleGithubActionsARN:
81+
Description: "CICD Role for GitHub Actions"
82+
Value: !GetAtt RoleGithubActions.Arn

0 commit comments

Comments
 (0)