GitHub Actions と OIDC 認証で AWS CDK のデプロイを自動化する

import * as cdk from "aws-cdk-lib";
import * as apigw from "aws-cdk-lib/aws-apigateway";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import * as lambda from "aws-cdk-lib/aws-lambda";
import { NodejsFunction } from "aws-cdk-lib/aws-lambda-nodejs";
import * as path from "path";

export class CdkGithubActionsStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const table = new dynamodb.Table(this, "ItemsTable", {
      partitionKey: { name: "id", type: dynamodb.AttributeType.STRING },
      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });

    const itemsFunction = new NodejsFunction(this, "ItemsFunction", {
      runtime: lambda.Runtime.NODEJS_22_X,
      entry: path.join(__dirname, "../src/lambda/items.ts"),
      handler: "handler",
      environment: {
        TABLE_NAME: table.tableName,
      },
    });

    table.grantReadWriteData(itemsFunction);

    const api = new apigw.RestApi(this, "ItemsApi", {
      restApiName: "Items Service",
      endpointTypes: [apigw.EndpointType.REGIONAL],
      defaultCorsPreflightOptions: {
        allowOrigins: apigw.Cors.ALL_ORIGINS,
        allowMethods: apigw.Cors.ALL_METHODS,
      },
    });

    const lambdaIntegration = new apigw.LambdaIntegration(itemsFunction);

    const items = api.root.addResource("items");
    items.addMethod("GET", lambdaIntegration);
    items.addMethod("POST", lambdaIntegration);

    const item = items.addResource("{id}");
    item.addMethod("GET", lambdaIntegration);
    item.addMethod("PUT", lambdaIntegration);
    item.addMethod("DELETE", lambdaIntegration);

    new cdk.CfnOutput(this, "ApiUrl", {
      value: api.url,
      description: "API Gateway URL",
    });

    new cdk.CfnOutput(this, "TableName", {
      value: table.tableName,
      description: "DynamoDB Table Name",
    });
  }
}

name: deploy

on:
  push:
    branches:
      - main

permissions:
  contents: read
  id-token: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v5
        with:
          version: 10

      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{secrets.AWS_ROLE_ARN }}
          aws-region: ap-northeast-1

      - run: pnpm cdk deploy --all --require-approval never

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AssumeCDKRoles",
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:ResourceTag/aws-cdk:bootstrap-role": [
            "image-publishing",
            "file-publishing",
            "deploy",
            "lookup"
          ]
        }
      }
    }
  ]
}