cloudformation.yml

Parameters:
  GitHubOrg:
    Type: String
    Default: Cloudbourn

Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRoleWithWebIdentity
            Principal:
              Federated: !Ref GithubOidc
            Condition:
              StringLike:
                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/*:*
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/PowerUserAccess # https://github.com/z0ph/MAMIP/blob/master/policies/PowerUserAccess
      Policies:
        - PolicyName: ModifySomeIAMButNotAll
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - iam:AttachRolePolicy
                  - iam:CreateRole
                  - iam:DeleteRole
                  - iam:DeleteRolePolicy
                  - iam:DetachRolePolicy
                  - iam:GetRole
                  - iam:GetRolePolicy
                  - iam:PassRole
                  - iam:PutRolePolicy
                  - iam:Tag*
                  - iam:Untag*
                Resource:
                  - '*'

  GithubOidc:
    Type: AWS::IAM::OIDCProvider
    Properties:
      Url: https://token.actions.githubusercontent.com
      ClientIdList:
        - sts.amazonaws.com
      ThumbprintList:
        - 6938fd4d98bab03faadb97b34396831e3780aea1

Outputs:
  Role:
    Value: !GetAtt Role.Arn