Secrets ManagerとGitHub Actionsを組み合わせて認証情報を管理する

- name: Step name
  uses: aws-actions/aws-secretsmanager-get-secrets@v2
  with:
    secret-ids: |
      ENVVAR, secretId1

❯ aws --version
aws-cli/2.17.23 Python/3.11.9 Darwin/25.1.0 exe/x86_64

❯ terraform --version
Terraform v1.14.1
on darwin_arm64

.
├── main.tf          # リソース定義
├── variables.tf     # 入力変数
├── outputs.tf       # 出力値
└── terraform.tfvars # 環境設定（要作成）

variable "github_org_or_user" {
  description = "GitHub organization name (for org repos) or username (for personal repos)"
  type        = string
}

variable "github_repo" {
  description = "GitHub repository name"
  type        = string
}

variable "aws_region" {
  description = "AWS region"
  type        = string
  default     = "ap-northeast-1"
}

github_org_or_user = "your-github-org-or-user-name"
github_repo = "your-github-repo-name"
aws_region = "ap-northeast-1"

resource "aws_iam_openid_connect_provider" "github_actions" {
  url            = "https://token.actions.githubusercontent.com"
  client_id_list = ["sts.amazonaws.com"]
}

data "aws_iam_policy_document" "github_actions_assume_role" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = [aws_iam_openid_connect_provider.github_actions.arn]
    }

    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }

    # 特定のリポジトリからのみアクセスを許可
    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:${var.github_org_or_user}/${var.github_repo}:*"]
    }
  }
}

resource "aws_iam_role" "github_actions" {
  name               = "github-actions-secrets-manager-role"
  assume_role_policy = data.aws_iam_policy_document.github_actions_assume_role.json
}

data "aws_iam_policy_document" "secrets_manager_access" {
  statement {
    effect    = "Allow"
    actions   = ["secretsmanager:GetSecretValue"]
    resources = [aws_secretsmanager_secret.db_credentials.arn]
  }
  statement {
    effect    = "Allow"
    actions   = ["secretsmanager:ListSecrets"]
    resources = ["*"]
  }
}

resource "aws_iam_role_policy" "secrets_manager_access" {
  name   = "secrets-manager-access"
  role   = aws_iam_role.github_actions.id
  policy = data.aws_iam_policy_document.secrets_manager_access.json
}

resource "aws_secretsmanager_secret" "db_credentials" {
  name        = "sample/db-credentials"
  description = "Database credentials for sample application"

  recovery_window_in_days = 7
}

resource "aws_secretsmanager_secret_version" "db_credentials" {
  secret_id = aws_secretsmanager_secret.db_credentials.id
  secret_string = jsonencode({
    host     = "db.example.com"
    port     = 5432
    username = "app_user"
    password = "initial-password-v1"
    database = "myapp"
  })
}

output "iam_role_arn" {
  description = "IAM role ARN for GitHub Actions"
  value       = aws_iam_role.github_actions.arn
}

# Terraformの初期化
terraform init

# Terraformの実行
terraform apply

name: "Sample GitHub Actions"

on:
  push:
    branches: [main]
  workflow_dispatch:  # 手動実行用

env:
  AWS_REGION: ap-northeast-1

# OIDC 認証に必要な権限
permissions:
  id-token: write
  contents: read

jobs:
  sample-github-actions:
    name: Sample GitHub Actions
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Get secrets from Secrets Manager
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: |
            DB_SECRETS, sample/db-credentials
          parse-json-secrets: true

      - name: Use secrets (demo)
        run: |
          echo "Database host: ${{ env.DB_SECRETS_HOST }}"
          echo "Database port: ${{ env.DB_SECRETS_PORT }}"
          echo "Database name: ${{ env.DB_SECRETS_DATABASE }}"
          echo "Database user: ${{ env.DB_SECRETS_USERNAME }}"
          echo "Database password: ${{ env.DB_SECRETS_PASSWORD }}"

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

- name: Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
    aws-region: ${{ env.AWS_REGION }}

- name: Get secrets from Secrets Manager
  uses: aws-actions/aws-secretsmanager-get-secrets@v2
  with:
    secret-ids: |
      DB_SECRETS, sample/db-credentials
    parse-json-secrets: true

- name: Use secrets (demo)
  run: |
    echo "Database host: ${{ env.DB_SECRETS_HOST }}"
    echo "Database port: ${{ env.DB_SECRETS_PORT }}"
    ...

git add .
git commit -m "Add GitHub Actions"
git push