圆环CI OIDC

这个寄存器包含通过一个开放的ID连接(OIDC)提供者在CircleCI和AWS之间通信的构造. 这个 进程在 这个 CircleCI 博客文章。 。 。 .

安全福利

通过使用 OpenID 连接提供者,您可以在不保存静态证书的情况下从 CircleCI 与 AWS 通信 (例如, AWS_ACCESS_KEY_ID 财务报告和审定财务报表 AWS_SECRET_ACCESS_KEY在您的 CircleCI 项目设置或上下文中。 删除静态 全权证书,特别是鉴于2023年初 违反,是一个 安全最佳做法.

快速启动

安装软件包 :

npm install @blimmer/cdk-circleci-oidc

or

yarn add @blimmer/cdk-circleci-oidc

然后,创建提供者和角色.

import { Stack, StackProps } from "aws-cdk-lib";
import { CircleCiOidcProvider, CircleCiOidcRole } from "@blimmer/cdk-circleci-oidc";
import { Construct } from "constructs";
import { ManagedPolicy, PolicyStatement } from "aws-cdk-lib/aws-iam";
import { Bucket } from "aws-cdk-lib/aws-s3";

export class CircleCiStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // The provider is only created _once per AWS account_. It might make sense to define this in a separate stack
    // that defines more global resources. See below for how to use import the provider in stacks that don't define it.
    const provider = new CircleCiOidcProvider(this, "OidcProvider", {
      // Find your organization ID in the CircleCI dashboard under "Organization Settings"
      organizationId: "11111111-2222-3333-4444-555555555555",
    });

    const myCircleCiRole = new CircleCiOidcRole(this, "MyCircleCiRole", {
      provider,
      roleName: "MyCircleCiRole",

      // Pass some managed policies to the role
      managedPolicies: [ManagedPolicy.fromAwsManagedPolicyName("AmazonS3ReadOnlyAccess")],
    });

    // You can work with the CircleCI role like any other role
    myCircleCiRole.addToPolicy(
      new PolicyStatement({
        actions: ["s3:ListAllMyBuckets"],
        resources: ["*"],
      }),
    );

    // Including using `.grant` convenience methods
    const bucket = new Bucket(this, "MyBucket");
    bucket.grantRead(myCircleCiRole);
  }
}

现在,在你 .circleci/config.yml 文件, 您可以使用 AWS CLI 轨道 担任你的新角色.

version: 2.1

orbs:
  aws-cli: circleci/[email protected] # https://circleci.com/developer/orbs/orb/circleci/aws-cli

workflows:
  version: 2
  build:
    jobs:
      - oidc-job:
          context: oidc-assumption # You _must_ use a context, even if it doesn't contain any secrets (see https://circleci.com/docs/openid-connect-tokens/#openid-connect-id-token-availability)

jobs:
  oidc-job:
    docker:
      - image: cimg/base:stable
    steps:
      - checkout
      # https://circleci.com/developer/orbs/orb/circleci/aws-cli#commands-setup
      - aws-cli/setup:
          role_arn: "arn:aws:iam::123456789101:role/MyCircleCiRole"
      - run:
          name: List S3 Buckets
          command: aws s3 ls

不定义提供者的堆栈使用

这个 CircleCiOidcProvider 仅创建 每账户一次您可以使用 CircleCiOidcProvider.fromOrganizationId 将先前创建的提供者导入到任意堆栈的方法.

import { Stack, StackProps } from "aws-cdk-lib";
import { CircleCiOidcRole, CircleCiOidcProvider } from "@blimmer/cdk-circleci-oidc";
import { Construct } from "constructs";

export class MyStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const myCircleCiRole = new CircleCiOidcRole(this, "MyCircleCiRole", {
      provider: CircleCiOidcProvider.fromOrganizationId(this, "11111111-2222-3333-4444-555555555555"),
      roleName: "MyCircleCiRole",
    });
  }
}

使用量

详细的API文件见 API.md (英语)。 。 。 .

蟒

Python 可用此软件包 cdk-circleci-oidc。 。 。 .

pip install cdk-circleci-oidc

主要版本之间的升级

API预计在主要版本之间会有所变化. 请咨询 更新文件 用于 资料.

捐款

欢迎贡献、问题和反馈!