wip: refactor to use oidc instead of iam users

Signed-off-by: Richard Case <[email protected]>

infra/aws/terraform/cncf-k8s-infra-aws-capa-ami/iam-imagebuilder.tf

@@ -15,33 +15,6 @@ limitations under the License.
 */
 
 
-resource "aws_iam_user" "imagebuilder" {
-  name = "imagebuilder"
-}
-
-resource "aws_iam_user_login_profile" "imagebuilder_login" {
-  user    = aws_iam_user.imagebuilder.name
-  password_reset_required = true
-}
-
-resource "aws_iam_access_key" "imagebuilder" {
-  user    = aws_iam_user.imagebuilder.name
-  pgp_key = "mQINBGKe9M0BEACqiPeuyj4wm7uIfLqeYxDwj6QFf9D/vxnusBEy3Y7AoIUsRE7hAIAIkKxFseqPsz1BjhZFUHyz7W81He4LH5NafzjR//Rb0h6acmJARHSyrBJsDC837CPxJJaVkhX2Y2rim+MJyqsPUxvCoEY+9mf1z6IOQLFS1eglGxyo7SI4JvZtNUS/SXfa1LhaQ11DtuVB0MPd86xCaXLMr5gUOreh63IySuXIZibeUNpZeqAVsm0OKhHb8qDSo2tCKUqUB4lCF4VkOnqetO4lQQlMHrW6S6O/HQ8X/PPXVVvR8L8IjDLVEp5UcIgQwNmy3uCOR6AYj6OpMxGLg9iTyidB2JPV+bynkanjWYXQAnHwfhL2F67ihPvV0FqX52n+WUdYjxqLV/sZcIDj9FNIvw+6043q7hx2N80p/aaX6yFHZmcw4ygpTblgWw/7JTu1gGtASY6Jik95UiyDmEOrLdo7PNQyajkKsTvEVHwHEI8SEMpJr1fLrJms5QDebG9vtfEAFa3a2/nv0tfv+eTBMSKLvjvAmh88m5rQjRaIi971N2BlYTkdsCgQQPV+kwT2vtuI12RAn/ykH76WuEjXVtEliQPVwrAJQxTAWND481Q7SohQI9VcdhARV66gCctTaooWQdTYDd2FU61XA4FEo7QV8czrcc1pnzSLOLU+Acr3NQMkrwARAQABtCdSaWNoYXJkIENhc2UgPHJpY2hhcmQuY2FzZUBvdXRsb29rLmNvbT6JAlcEEwEKAEECGwMFCQPCZwAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQQhvJMGF6FmKNZ2lAsxfINc3qmMzQUCY900uQIZAQAKCRAxfINc3qmMzYOyD/4otNj6bBJdiSbuFRR4kUkJX/LlaqHZwLoYwHOg1Xky4mJWDZYG+ygpbqk/Tfir9yBmbADOyyCYabn9uqtE75VzLzKlOZNrC0gUguEqWnwa7nyAaN7rk1uoeIgQ7gvtdJJhGz177WpefTo4sevB3nB/Xg12UWlXqjjQgcAF6o1CalULMJjBvJ0vMiwunNd9eI9Jk9sEvQ/hnXODmubCqBOd53m/K03bBY7Gnl+wF/y6POBCCNHpYsWQ6z/DMl/vUJA/wsuu/6S8rpS9kkJ7xoX6dvfzsSLV6RUHA6eHbuuaLRJPVTYjIZVgFCuw8U2iB8e4h9PNOorNNprOPz8DcAkAayaZRk9YJji+tW8H6rH84BW7K2DCQ3fmrugwG3MW29wb2GiLGgMKtEGJjJGGbVMEDl1GH7ndP8WyfNY1qRIvHQN6gBLrA5N++PM9fvm0bi5D1vOr+0gtBwshgmNb3OoK+SKhxynei2demXYgA+N8NXgPZYren6SPurD8bHW+T0hoIA+HW00Yq6SS/WX2IONCUkjnkD9sZ5Wef+TjscdTvdLhwCFYoF9jETG1i2dzbQ2G8e9D7abhJxusR4XtKZehb0CMipKSNs73YquTWkCaMijaDRdIeeQlBi2TwqQ6hZZTj+9aG+dLGj6itiVcQMw8QoxOaexspPAL6bLSgz7dCokCVAQTAQoAPhYhBCG8kwYXoWYo1naUCzF8g1zeqYzNBQJinvTNAhsDBQkDwmcABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEDF8g1zeqYzNx2oP/jEDh8oMOZw36PcDRiXyzb5yoCoYYtEB2YIIlzjTx59qVSvXAG6zZPdLZi6qOrnmylFIRzFMgxlb651KzV0tp4Qh10tv21GCgbi4s5p9RL6ZccSiRb48TTyvMNZCLpBIss+nM6cVpazpYhmVRwdC5pPicpT6BGpPCv0pQlka16jY9Xv3m9ywPO6XvLcdCYTD34ekKmnaySLSC6JBOuwLfRfCHOBotb0TDxTi7GXY7BP/U3rzJlXUJ+DzpKNAwUxfH/eE++0lUCtbAsnvr6uyV1pdN3PCU6RkED3pEEPKl7eyXxiLHlVibqNTx9d9qAz1Zg2zfXzXPAhT971MkOeuzWyMESuhImnRAogqzFMtf0rOzj8ksZ/29SV28wif5fCJVPzhQBbZFpFe3wmj3NtR7CxlHd9Zdyp2tzzycPTywLgNX26BN9EmrmKMfVMYLnJq/60lPLVe5XSl2jx19T1oYHXJuP3wUwDbkmWMaVVvkyo8R5bcGWCOpfMcaw/7P8l12G9ti5VGWCC/O7slGkRGW/9Ey3o75F0LmKOGZmqOr44YRlK9Vl1zbNoej5tZVxYnYvIErauYG1HqPNnWM0HAIVS+r7kNRj6j+9iAXiwOycLkdmHzkeNRdsfaUVf5drpwgoTZW4/+ZtJLrK8lhpeviIWWq3iQm9/qxbfKyqww1AxTtCJSaWNoYXJkIENhc2UgPHJpY2htY2FzZUBnbWFpbC5jb20+iQJSBBMBCgA8FiEEIbyTBhehZijWdpQLMXyDXN6pjM0FAmPdNIcCGwMFCQPCZwAECwkIBwQVCgkIBRYCAwEAAh4FAheAAAoJEDF8g1zeqYzNx7YP/0DDDHD57kvVqa9B0yrNBSBZRLIGLMSQaibYt3C0SLCrM1kj3TJMVnp7PjdII6BI1Io7mbroDELNFvvmFKLCGKyIonhK3qPWoZ8DgXjTyrHMqDVUKiwu8Z3xCWsLhO6nabcJbXmrw79fRCojaxUrNRZMFa3xxeT4RXQ8w58pSRRke/AfVfWXcl3eoCK2dakR7WtM5CzESb+XSeE6aFCylLL3rgc/94oC1bOdHenbr4NJ0Qx07sKZY1DW3S2TcnWt748a6XD0RIjL8wLolEfc/Rsxxg89TKEaU4IhlUCo3kV0h2gtzW2Bx5RFBvpRHP4TksZhBUX3j8RDb1U14ksWt+mMVBctwQpbhoVBEALGT03qXXHwwiKV1OUqi+KTo+xVdDsLljhdBgGGv8UsllyWRDB1oOCIRO44HM60z7A5q9kqFkLcSL7puD5PWrpb/fDhh8oUHfVjqanzaXP0Q7LJcm/NLxtiJfPfK/aDamtIrQNKnGnqshmUqc29Y0nB87EXOMD9FzkxQHG6mBb5CJx1YTEcdUji+JhM1BDIr5gfwn94whsJYeTdSJny1MjQaUZUs28p8V+p6eawH3gY2M6QiTRsGz8vNtIzp7RLsX4xxuGznm67Id0xKkE2L1aOtTCJQ5AoVq+Jz9BreQsiNdBQEdcBlxbwyR6BLw7UnDwE0IfKuQINBGKe9RoBEADa9lXpjdRraUoPI4wrZ/mr/Ck1tGZ+7t4kcSS5j9GOkLe5qgv6f5IrDouh0cGF4+ksR7lqAdv3i5OGBCDhlu6G2KMqH8wGx6gMfHNnSPqdozYTalkhn0j16V6RRUUzugZ/XSQOAs/5haJuM82ZYGppZkjaujiEX3uHZ0pAXzUjnpGK9S6PaI0j1rEGQJjaCItiJoH4XpSIRUz7nxTJTVRjlRvW3yIeXzytlJN/QbE25aPWECe/cQgu00eRb6ILM27kcBGNkFpCAuTa5GTzOljjsCgox8Vts2MX82XIigG+3L1Yx+dh9OwlWbJBNPkI7iZpciOdejJkqMo/d8n8jtWmJuOlD30nj/lAeoUdYJ6Dv80QpM6idsWFEThjERb9qI0ym9r5GBHoTYWMpAtuDXN+PeUNe8YJ98v4lpYZRKbyp399uHB72q6eXq/J3C9uo8t8kTevVR5wwc6JOPi9bdjMQBW1YzsOAGkaL1eG6AQL4GLnPGy26jPsdVQFk87hbyFCMBP+vS14do0v++eLHVQE9vzI8p/hvLtEV+SF2p5+vU4bthDyctU9c+JHISPHWON7iLuxO8GYweI+ZZ0zgixcEIhILX32P6rX7g8OxD/zvfLDq/L/Rg0V/EmPij8j0JDHdmnAObpG8+fVUQfv5UFo2/547LWuOskT/xM+JII4IwARAQABiQI8BBgBCgAmFiEEIbyTBhehZijWdpQLMXyDXN6pjM0FAmKe9RoCGyAFCQPCZwAACgkQMXyDXN6pjM0WShAApqfsvpVR9m1dA5I/7dO7kzaedE1s6dAlRVTqQXE2TTVdnriQin+gYQjJyMsZRNe0w3oTWYgS1QYToZ+hJoY5hGogqjHpTl0u0LsynLCAo9jbnoLfswwO2LXijdyT0C1IQfz6FuMX7HKoNz/PfHK6SfKqBzKs/rO/jZSpkR1sw2ZSqdjOR9WwJ81CPMY/aFSiq2Q3Fkf7HovbUAMz1gRW5FHgmxfyDELVEQbVeLjzn2lC1eQraVH3Fw7ix4tGrwPj7+C87lKnktUaF1hUyiMlCjYkcHkKyaxEFwf68E3bIpPEUwIkibHqTGuD5M1dQYPRB6wXg1wwxPuTTJkDHhAYPu7xGKRx/mRg8mQ/HkTkccKugq6iGZgt9vxSqUob9/My7lCUqPYYxDR9jnN1HGfSA4n50FRXtHUIN279SOTjhiofmYq+uF4a/MaCDrc+owyWP2Vphl2mGJxFalLVwVRI/vIZz088qZ04w/O/FS2UeAGqqPxgSQjKmT42LyMp9lAGi+zbgVAdfGgoMULscbR6Otr5GiH9weq0toMqVjRRc6DyIFal0LSEqQavCnaQhstTDyfObCrORa62Kb8eNytrhf5Y58pZJ92cv0PlXTef7tqBV3y5HgPu06TiE2flydFokqJWGloZAuPB5IOxkMumveL8whTbKXP+Kf3qHue6bje5Ag0EYp70zQEQAKUCctDmoP7NNj8g+fmCBjB2Vb+msEFuM3kWaBP4J3Byz7MmGTkaBNqp8ZtJ7cOyTTVAXf2OX13qv/jXxd1k0c2krKjhFe9mZkdcK+unfYRvH74qswmOkpmLbWjbYsQ2rCmlUYPfMTE5inlFu0/gMxY0saoni2u5jB8eEqcdBq/skFwOggO1mngPZnh+A6nVKSI+7+Z8cmbzVANyg5JxDlsO5j7kbZP3Qc+Hg1IzoAkjeHtdhpvU4/gbzA61pubRn/mcPjK5YUSoXIhnUcQEk+/D1wxrwlD2unBsuFMFw87SDuhMzEyblIFc4he3ukgBfrNpW6LBp2NbVI3+YQFVd+i0uoo475/uYexRVZLicFOWIXdP6ak0K5ox9vV2PCbfJwyuDe6pFumshtdFcua0h7UP1qOpqb5tAFQKvdKWHsA/DbXW0cwssni6mhj8GxcUNJoATu2IvdGwCFGgzr4iDOS5AvAEwgQJWCUHCOW/pAso/IDArUxqX32q0r/qJ5KIqcnDpPFtDoiV30MaZrTFz9Qj9Z4qLusJpULO4GWYwwVmB2q7J6/1CfxZiuEYxd3OcAahdbp998pCmQIvbdGBOvzMP1grX1dxBeIdDDBgn/emKa++a6HPb19PHawclpQV0EuHxQ9a3m9ymlr1E/8lpOfqImN6N0Kd4/pUvHILhxJ7ABEBAAGJAjwEGAEKACYWIQQhvJMGF6FmKNZ2lAsxfINc3qmMzQUCYp70zQIbDAUJA8JnAAAKCRAxfINc3qmMzR6PEACbSFg5y+wp8e4vdCJKpxMOLxzlZ1hOikfJQ5XnllagNTktvP8CGVcgdbutDOOZ3j+0lDXS7+QF19LzoIrpMiY5R1eQOfaiqbWMoe+f2cM4h60yScjHP/+DT7SZ9WHgG2a2BqZ/6/ixcwMT570nObDTCK3RR8pyY+KpFJY/9XFhc7l4tSz1Jx851noQvVFLEPqSEILAIg46V/tb9eiZ+LkpapDEksqnoyU5eS0uO770zeCFRWh9DesH14qLNmFwgYO2Rh5sYNtNp12G1Mzy1I6VSpaBZBh/CaKP6oaNG/0xJiY5m74kN9aTLRwBScbLIMT07KBM919oLRHjzDaMj657xTYLSqlew2q5XHqjTosopXHpRier/67MBU5LmleJ0ipTDDu+5cKlXteU9pIBj4YgyBVC/PtSHO3SbvDR7xdgFJs7JitkazONMrKf1ejXO/QF62MnRlGttAn96yJz4quowMIUFD1Fl8Vjj2/mCDQiPtYvjy/5s5Qoz+F3CJxejEEaaxSivdvg3bECkzEA2Ii/SZ9Nr8o9yDByOUHo16a1qEoxfSfpsvU0c30oUL+jYk2FlT80JnTf8VQczE+Q/M0E6/q/xI5C5nW9bYT8A1Dln47VGBmtGxkNZETilda5IjNyU4rmsAO6GxFalk3woAGBQ9XmDj1pyrieUbcj1k22QA=="
-}
-
-output "imagebuilder_accesskey" {
-  value = aws_iam_access_key.imagebuilder.encrypted_secret
-}
-
-output "imagebuilder_keyid" {
-  value = aws_iam_access_key.imagebuilder.id
-}
-
-resource "aws_iam_user_policy_attachment" "test-attach" {
-  user       = aws_iam_user.imagebuilder.name
-  policy_arn = aws_iam_policy.imagebuilder.arn
-}
-
 resource "aws_iam_policy" "imagebuilder" {
   name        = "capa-image-builder-policy"
   path        = "/"

infra/aws/terraform/cncf-k8s-infra-aws-capa-ami/oidc.tf

@@ -0,0 +1,42 @@
+resource "aws_iam_openid_connect_provider" "github" {
+  url = "https://token.actions.githubusercontent.com"
+
+  client_id_list = [
+    "sts.amazonaws.com",
+  ]
+
+  thumbprint_list = ["d89e3bd43d5d909b47a18977aa9d5ce36cee184c"]
+}
+
+data "aws_iam_policy_document" "capa-gh-trust" {
+    statement {
+      actions = ["sts:AssumeRoleWithWebIdentity"]
+
+      principals {
+        type        = "Federated"
+        identifiers = [aws_iam_openid_connect_provider.github.arn]
+      }
+
+      condition {
+        test = "ForAnyValue:StringEquals"
+        variable = "token.actions.githubusercontent.com:aud"
+        values = ["sts.amazonaws.com"]
+      }
+
+      condition {
+        test = "StringLike"
+        variable = "token.actions.githubusercontent.com:sub"
+        values = ["repo:kubernetes-sigs/cluster-api-provider-aws"]
+      }
+    }
+}
+
+resource "aws_iam_role" "gh-image-builder" {
+  name = "gh-image-builder"
+  assume_role_policy = data.aws_iam_policy_document.capa-gh-trust.json
+}
+
+resource "aws_iam_role_policy_attachment" "gh-image-builder" {
+  role       = aws_iam_role.gh-image-builder.name
+  policy_arn = aws_iam_policy.imagebuilder.arn
+}

infra/aws/terraform/cncf-k8s-infra-aws-capa-ami/providers.tf

@@ -17,12 +17,12 @@ limitations under the License.
 terraform {
   backend "s3" {}
 
-  required_version = "~> 1.6.0"
+  required_version = "~> 1.8.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 5.35"
+      version = "~> 5.66"
     }
   }
 }