feat: github-oidc multiple roles map

[marekaf]

No description provided.

[github-actions]

Terraform plan in examples/03-aws-github-actions-oidc

Plan: 3 to add, 0 to change, 2 to destroy, 1 to move.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
-   destroy
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_iam_role_policy.github_actions_push_to_ecr must be replaced
-/+ resource "aws_iam_role_policy" "github_actions_push_to_ecr" {
!~      id     = "*****************************************" -> (known after apply)
        name   = "github-actions-push-to-ecr"
!~      role   = "github_actions" -> "github_actions_deployer" # forces replacement
#        (1 unchanged attribute hidden)
    }

  # module.github_oidc_custom_policy.aws_iam_openid_connect_provider.github has moved to module.github_oidc_custom_policy.aws_iam_openid_connect_provider.github[0]
    resource "aws_iam_openid_connect_provider" "github" {
        id              = "arn:aws:iam::175912345102:oidc-provider/token.actions.githubusercontent.com"
        tags            = {}
#        (5 unchanged attributes hidden)
    }

  # module.github_oidc_custom_policy.aws_iam_role.github_actions will be destroyed
  # (because resource uses count or for_each)
-   resource "aws_iam_role" "github_actions" {
-       arn                   = "arn:aws:iam::175912345102:role/github_actions" -> null
-       assume_role_policy    = jsonencode(
            {
-               Statement = [
-                   {
-                       Action    = "sts:AssumeRoleWithWebIdentity"
-                       Condition = {
-                           StringLike = {
-                               "token.actions.githubusercontent.com:sub" = "*************************"
                            }
                        }
-                       Effect    = "Allow"
-                       Principal = {
-                           Federated = "arn:aws:iam::175912345102:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
-               Version   = "2012-10-17"
            }
        ) -> null
-       create_date           = "2022-09-02T10:15:21Z" -> null
-       force_detach_policies = false -> null
-       id                    = "github_actions" -> null
-       managed_policy_arns   = [] -> null
-       max_session_duration  = 3600 -> null
-       name                  = "github_actions" -> null
-       path                  = "/" -> null
-       tags                  = {} -> null
-       tags_all              = {} -> null
-       unique_id             = "AROASR5JRLYHNFYWMJDQV" -> null

-       inline_policy {
-           name   = "github-actions-push-to-ecr" -> null
-           policy = jsonencode(
                {
-                   Statement = [
-                       {
-                           Action   = [
-                               "ecr:UploadLayerPart",
-                               "ecr:PutImage",
-                               "ecr:InitiateLayerUpload",
-                               "ecr:GetDownloadUrlForLayer",
-                               "ecr:CompleteLayerUpload",
-                               "ecr:BatchGetImage",
-                               "ecr:BatchCheckLayerAvailability",
                            ]
-                           Effect   = "Allow"
-                           Resource = "arn:aws:ecr:eu-west-1:175912345102:repository/test"
-                           Sid      = ""
                        },
                    ]
-                   Version   = "2012-10-17"
                }
            ) -> null
        }
    }

  # module.github_oidc_custom_policy.aws_iam_role.github_actions["github_actions_deployer"] will be created
+   resource "aws_iam_role" "github_actions" {
+       arn                   = (known after apply)
+       assume_role_policy    = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = "sts:AssumeRoleWithWebIdentity"
+                       Condition = {
+                           StringLike = {
+                               "token.actions.githubusercontent.com:sub" = "*************************"
                            }
                        }
+                       Effect    = "Allow"
+                       Principal = {
+                           Federated = "arn:aws:iam::175912345102:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       create_date           = (known after apply)
+       force_detach_policies = false
+       id                    = (known after apply)
+       managed_policy_arns   = (known after apply)
+       max_session_duration  = 3600
+       name                  = "github_actions_deployer"
+       name_prefix           = (known after apply)
+       path                  = "/"
+       tags_all              = (known after apply)
+       unique_id             = (known after apply)
    }

  # module.github_oidc_custom_policy.aws_iam_role.github_actions["github_actions_terraform"] will be created
+   resource "aws_iam_role" "github_actions" {
+       arn                   = (known after apply)
+       assume_role_policy    = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = "sts:AssumeRoleWithWebIdentity"
+                       Condition = {
+                           StringLike = {
+                               "token.actions.githubusercontent.com:sub" = "***************************"
                            }
                        }
+                       Effect    = "Allow"
+                       Principal = {
+                           Federated = "arn:aws:iam::175912345102:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       create_date           = (known after apply)
+       force_detach_policies = false
+       id                    = (known after apply)
+       managed_policy_arns   = [
+           "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser",
        ]
+       max_session_duration  = 3600
+       name                  = "github_actions_terraform"
+       name_prefix           = (known after apply)
+       path                  = "/"
+       tags_all              = (known after apply)
+       unique_id             = (known after apply)
    }

Plan: 3 to add, 0 to change, 2 to destroy.

📝 Plan generated in terraform-plan-03-aws-github-actions-oidc #169

[github-actions]

Terraform plan in examples/01-minimal-aws-cloudformation-bootstrap

No changes. Your infrastructure matches the configuration.

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in terraform-plan-01-minimal-aws-cloudformation-bootstrap #174

[github-actions]

Terraform plan in examples/02-minimal-gcp-tf-bootstrap

No changes. Your infrastructure matches the configuration.

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in terraform-plan-02-minimal-gcp-tf-bootstrap #177