You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+17-12Lines changed: 17 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@
9
9
This Terraform module creates a Workload Identity Pool and Provider for GitHub.
10
10
11
11
Service account keys are a security risk if compromised.
12
-
Avoid service account keys and instead use the [Workload Identity Federation](https://cloud.google.com/iam/docs/configuring-workload-identity-federation).
12
+
Avoid service account keys and instead use the [Workload Identity Federation](https://github.com/Cyclenerd/google-workload-identity-federation#readme).
13
13
For more information about Workload Identity Federation and how to best authenticate service accounts on Google Cloud, please see my GitHub repo [Cyclenerd/google-workload-identity-federation](https://github.com/Cyclenerd/google-workload-identity-federation#readme).
14
14
15
15
> There is also a ready-to-use Terraform module for [GitLab](https://github.com/Cyclenerd/terraform-google-wif-gitlab#readme).
> The attributes `attribute.sub` and `attribute.repository` are used in the Terrform module [Cyclenerd/wif-service-account/google](https://github.com/Cyclenerd/terraform-google-wif-service-account).
| `attribute.sub` | `assertion.sub` | Defines the subject claim that is to be validated by the cloud provider. This setting is essential for making sure that access tokens are only allocated in a predictable way.
70
-
| `attribute.actor` | `assertion.actor` | The personal account that initiated the workflow run.
71
73
| `attribute.repository` | `assertion.repository` | The repository from where the workflow is running
74
+
| `attribute.aud` | `assertion.aud` | Audience
75
+
| `attribute.iss` | `assertion.iss` | The issuer of the OIDC token: `https://token.actions.githubusercontent.com`
76
+
| `attribute.actor` | `assertion.actor` | The personal account that initiated the workflow run.
72
77
| `attribute.actor_id` | `assertion.actor_id` | The ID of personal account that initiated the workflow run.
73
78
| `attribute.base_ref` | `assertion.base_ref` | The target branch of the pull request in a workflow run.
74
79
| `attribute.environment` | `assertion.environment` | The name of the environment used by the job.
75
80
| `attribute.event_name` | `assertion.event_name` | The name of the event that triggered the workflow run.
76
81
| `attribute.head_ref` | `assertion.head_ref` | The source branch of the pull request in a workflow run.
77
-
| `attribute.job_workflow_ref` | `assertion.job_workflow_ref` | For jobs using a reusable workflow, the ref path to the reusable workflow. For more information, see "Using OpenID Connect with reusable workflows.
82
+
| `attribute.job_workflow_ref` | `assertion.job_workflow_ref` | For jobs using a reusable workflow, the ref path to the reusable workflow. For more information, see [Using OpenID Connect with reusable workflows](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/using-openid-connect-with-reusable-workflows).
78
83
| `attribute.job_workflow_sha` | `assertion.job_workflow_sha` | For jobs using a reusable workflow, the commit SHA for the reusable workflow file.
79
84
| `attribute.ref` | `assertion.ref` | (Reference) The git ref that triggered the workflow run.
80
-
| `attribute.ref_type` | `assertion.ref_type` | The type of ref, for example: "branch".
81
-
| `attribute.repository_visibility` | `assertion.repository_visibility` | The visibility of the repository where the workflow is running. Accepts the following values: internal, private, or public.
85
+
| `attribute.ref_type` | `assertion.ref_type` | The type of `ref`, for example: "branch".
86
+
| `attribute.repository_visibility` | `assertion.repository_visibility` | The visibility of the repository where the workflow is running. Accepts the following values: `internal`, `private`, or `public`.
82
87
| `attribute.repository_id` | `assertion.repository_id` | The ID of the repository from where the workflow is running.
83
-
| `attribute.repository_owner` | `assertion.repository_owner` | The name of the organization in which the repository is stored.
84
-
| `attribute.repository_owner_id` | `assertion.repository_owner_id` | The ID of the organization in which the repository is stored.
88
+
| `attribute.repository_owner` | `assertion.repository_owner` | The name of the organization in which the `repository` is stored.
89
+
| `attribute.repository_owner_id` | `assertion.repository_owner_id` | The ID of the organization in which the `repository` is stored.
85
90
| `attribute.run_id` | `assertion.run_id` | The ID of the workflow run that triggered the workflow.
86
91
| `attribute.run_number` | `assertion.run_number` | The number of times this workflow has been run.
87
92
| `attribute.run_attempt` | `assertion.run_attempt` | The number of times this workflow run has been retried.
88
-
| `attribute.runner_environment` | `assertion.runner_environment` | The type of runner used by the job. Accepts the following values: github-hosted or self-hosted.
93
+
| `attribute.runner_environment` | `assertion.runner_environment` | The type of runner used by the job. Accepts the following values: `github-hosted` or `self-hosted`.
89
94
| `attribute.workflow` | `assertion.workflow` | The name of the workflow.
90
-
| `attribute.workflow_ref` | `assertion.workflow_ref` | The ref path to the workflow. For example, octocat/hello-world/.github/workflows/my-workflow.yml@refs/heads/my_branch.
91
-
|`attribute.workflow_sha`|`assertion.workflow_sha`| The commit SHA for the workflow file.|
95
+
| `attribute.workflow_ref` | `assertion.workflow_ref` | The ref path to the workflow. For example, `octocat/hello-world/.github/workflows/my-workflow.yml@refs/heads/my_branch`.
96
+
| `attribute.workflow_sha` | `assertion.workflow_sha` | The commit SHA for the workflow file.
92
97
93
98
<!-- BEGIN_TF_DOCS -->
94
-
## Provi| s
99
+
## Providers
95
100
96
101
| Name | Version |
97
102
|------|---------|
@@ -102,7 +107,7 @@ Default attribute mapping:
102
107
| Name | Description | Type | Default | Required |
| <aname="input_issuer_uri"></a> [issuer\_uri](#input\_issuer\_uri)| Workload Identity Pool Provider issuer URI |`string`|`"https://token.actions.githubusercontent.com"`| no |
107
112
| <aname="input_pool_description"></a> [pool\_description](#input\_pool\_description)| Workload Identity Pool description |`string`|`"Workload Identity Pool for GitHub (Terraform managed)"`| no |
108
113
| <aname="input_pool_disabled"></a> [pool\_disabled](#input\_pool\_disabled)| Workload Identity Pool disabled |`bool`|`false`| no |
0 commit comments