OpenTacoで複数のAWSアカウントにリソースをデプロイしてみる(configure-aws-credentialsで名前付きAWSプロファイル設定)

├── ./.github
│   └── ./.github/workflows/digger_workflow.yml
├── ./digger.yml
├── ./prod
│   └── ./prod/main.tf
├── ./stg
│   └── ./stg/main.tf
└── ./README.md

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "6.28.0"
    }
  }
  backend "s3" {
    bucket  = "terraform-state-{PROD_ACCOUNT_ID}"
    key     = "terraform.tfstate"
    region  = "ap-northeast-1"
    profile = "prod"
  }
}

provider "aws" {
  region  = "us-east-1"
  profile = "prod"
}

projects:
- name: production
  dir: prod
- name: staging
  dir: stg

name: Digger Workflow

on:
  workflow_dispatch:
    inputs:
      spec:
        required: true
      run_name:
        required: false

run-name: '${{inputs.run_name}}'

jobs:
  digger-job:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: write
      id-token: write
      pull-requests: write
      issues: read
      statuses: write

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS Credentials for Prod
        uses: aws-actions/configure-aws-credentials@v6.1.0
        with:
          aws-region: ap-northeast-1
          role-to-assume: arn:aws:iam::{PROD_ACCOUNT_ID}:role/terraform-deploy
          aws-profile: prod

      - name: Configure AWS Credentials for Stg
        uses: aws-actions/configure-aws-credentials@v6.1.0
        with:
          aws-region: ap-northeast-1
          role-to-assume: arn:aws:iam::{STG_ACCOUNT_ID}:role/terraform-deploy
          aws-profile: stg

      - uses: diggerhq/digger@vLatest
        with:
          digger-spec: ${{ inputs.spec }}
          setup-aws: false
          setup-terraform: true
          terraform-version: 1.14.3
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}