@bifravst/ci/dist/RepoPermission.js

Sets up the permissions in our CI account for all repositories in this account to be able to use it for CI runs.

import { Duration, aws_iam as IAM, Stack } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { sanitize } from './sanitize.js';
export class RepoPermission extends Construct {
    role;
    constructor(parent, id, { repository, gitHubOICDProviderArn, }) {
        super(parent, id);
        const gitHubOIDC = IAM.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, 'gitHubOICDProvider', gitHubOICDProviderArn);
        this.role = new IAM.Role(this, 'ghRole', {
            roleName: `${Stack.of(this).stackName}-${sanitize(repository.name)}`,
            assumedBy: new IAM.WebIdentityPrincipal(gitHubOIDC.openIdConnectProviderArn, {
                StringEquals: {
                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com',
                },
                StringLike: {
                    [`token.actions.githubusercontent.com:sub`]: `repo:${repository.owner}/${repository.name}:*`,
                },
            }),
            description: `This role is used by GitHub Actions to run Continuous Integration Tests ${Stack.of(this).stackName} in the repository ${repository.owner}/${repository.name} (${repository.id}).`,
            maxSessionDuration: Duration.hours(1),
            managedPolicies: [
                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'),
            ],
        });
    }
}