setup-github-oidc.sh

#!/bin/bash

# GitHub OIDC Setup for AWS
# Sets up GitHub Actions OIDC provider and IAM role in AWS
# 
# Usage:
#   curl -sSL https://raw.githubusercontent.com/user/repo/main/setup-github-oidc.sh | bash -s owner/repo
#   
#   OR download and run locally:
#   ./setup-github-oidc.sh owner[/repo] [branch] [role-name] [policy] [aws-profile]
#
# Examples:
#   ./setup-github-oidc.sh myorg                                   # All repos, main branch, AdministratorAccess
#   ./setup-github-oidc.sh myorg/myrepo                           # Specific repo, main branch
#   ./setup-github-oidc.sh myorg/myrepo develop                   # Specific repo and branch
#   ./setup-github-oidc.sh myorg main GitHubRole PowerUserAccess dev  # Full customization with AWS profile

set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# GitHub OIDC provider details
GITHUB_OIDC_URL="https://token.actions.githubusercontent.com"
GITHUB_THUMBPRINT="6938fd4d98bab03faadb97b34396831e3780aea1"

print_usage() {
    echo "Usage: $0 <owner[/repo]> [branch] [role-name] [policy] [aws-profile]"
    echo
    echo "Parameters:"
    echo "  owner[/repo] GitHub owner/repo (e.g., 'myorg' or 'myorg/myrepo')"
    echo "  branch       Branch name (optional, defaults to 'main')"
    echo "  role-name    IAM role name (optional, defaults to 'GitHubActionsRole')"
    echo "  policy       AWS managed policy name (optional, defaults to 'AdministratorAccess')"
    echo "  aws-profile  AWS CLI profile name (optional, uses default profile)"
    echo
    echo "Examples:"
    echo "  $0 myorg"
    echo "  $0 myorg/myrepo"
    echo "  $0 myorg/myrepo develop"
    echo "  $0 myorg main GitHubRole PowerUserAccess"
    echo "  $0 myorg/myrepo main GitHubRole PowerUserAccess production"
    exit 1
}

log() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

error() {
    echo -e "${RED}[ERROR]${NC} $1"
    exit 1
}

check_prerequisites() {
    log "Checking prerequisites..."
    
    if ! command -v aws &> /dev/null; then
        error "AWS CLI is not installed. Please install it first: https://aws.amazon.com/cli/"
    fi
    
    if ! aws sts get-caller-identity &> /dev/null; then
        error "AWS credentials not configured. Run 'aws configure' first."
    fi
    
    local account_id=$(aws sts get-caller-identity --query Account --output text)
    local user_arn=$(aws sts get-caller-identity --query Arn --output text)
    
    success "AWS credentials configured"
    log "Account: $account_id"
    log "Identity: $user_arn"
}

create_oidc_provider() {
    log "Creating GitHub OIDC provider..." >&2
    
    local provider_arn=$(aws iam list-open-id-connect-providers --query "OpenIDConnectProviderList[?contains(Arn, 'token.actions.githubusercontent.com')].Arn" --output text 2>/dev/null || echo "")
    
    if [[ -n "$provider_arn" ]]; then
        warn "GitHub OIDC provider already exists: $provider_arn" >&2
        echo "$provider_arn"
        return 0
    fi
    
    local new_provider_arn=$(aws iam create-open-id-connect-provider \
        --url "$GITHUB_OIDC_URL" \
        --client-id-list "sts.amazonaws.com" \
        --thumbprint-list "$GITHUB_THUMBPRINT" \
        --query 'OpenIDConnectProviderArn' \
        --output text)
    
    success "Created GitHub OIDC provider: $new_provider_arn" >&2
    echo "$new_provider_arn"
}

create_trust_policy() {
    local github_org="$1"
    local repo_name="$2"
    local branch="$3"
    local provider_arn="$4"
    
    local subject_condition
    if [[ -n "$repo_name" ]]; then
        subject_condition="repo:${github_org}/${repo_name}:ref:refs/heads/${branch}"
    else
        subject_condition="repo:${github_org}/*"
    fi
    
    cat << EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "$provider_arn"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "$subject_condition"
                }
            }
        }
    ]
}
EOF
}

create_role() {
    local role_name="$1"
    local policy_name="$2"
    local trust_policy="$3" # This is now a file path
    local github_org="$4"
    local repo_name="$5"
    
    log "Creating IAM role: $role_name" >&2
    
    # Check if role already exists
    if aws iam get-role --role-name "$role_name" &> /dev/null; then
        warn "Role $role_name already exists. Updating trust policy..." >&2
        
        # Update trust policy
        aws iam update-assume-role-policy \
            --role-name "$role_name" \
            --policy-document file://$trust_policy
        
        success "Updated trust policy for existing role: $role_name" >&2
    else
        # Create new role
        local description="GitHub Actions role for ${github_org}"
        if [[ -n "$repo_name" ]]; then
            description="$description/$repo_name"
        fi
        
        aws iam create-role \
            --role-name "$role_name" \
            --assume-role-policy-document file://$trust_policy \
            --description "$description" \
            --max-session-duration 3600
        
        success "Created IAM role: $role_name" >&2
    fi
    
    # Attach managed policy
    log "Attaching managed policy: $policy_name" >&2
    aws iam attach-role-policy \
        --role-name "$role_name" \
        --policy-arn "arn:aws:iam::aws:policy/$policy_name"
    
    success "Attached policy $policy_name to role $role_name" >&2
    
    # Get role ARN
    local role_arn=$(aws iam get-role --role-name "$role_name" --query 'Role.Arn' --output text)
    echo "$role_arn"
}

main() {
    echo "🚀 GitHub OIDC Setup for AWS"
    echo "============================="
    echo
    # Positional arguments (required)
    local owner_repo=""
    local branch=""
    # Optional named arguments
    local role_name="GitHubActionsRole"
    local policy_name="AdministratorAccess"
    local aws_profile=""

    # Parse command-line arguments
    while [[ $# -gt 0 ]]; do
      case "$1" in
        --role)
          role_name="$2"; shift 2;;
        --policy)
          policy_name="$2"; shift 2;;
        --profile)
          aws_profile="$2"; shift 2;;
        --help|-h)
          print_usage;;
        *)
          if [[ -z "$owner_repo" ]]; then
            owner_repo="$1"
          elif [[ -z "$branch" ]]; then
            branch="$1"
          else
            echo "Unknown extra argument: $1"; print_usage
          fi
          shift;;
      esac
    done

    # Validate required arguments
    if [[ -z "$owner_repo" || -z "$branch" ]]; then
      print_usage
    fi

    # Parse owner/repo format
    local github_org
    local repo_name
    if [[ "$owner_repo" == *"/"* ]]; then
      github_org="${owner_repo%/*}"
      repo_name="${owner_repo#*/}"
    else
      github_org="$owner_repo"
      repo_name=""
    fi

    # Set AWS profile if provided
    if [[ -n "$aws_profile" ]]; then
      export AWS_PROFILE="$aws_profile"
      log "Using AWS profile: $aws_profile"
    fi

    # Display configuration
    echo "Configuration:"
    echo "  GitHub Owner: $github_org"
    echo "  Repository: ${repo_name:-All repositories}"
    echo "  Branch: $branch"
    echo "  Role Name: $role_name"
    echo "  Policy: $policy_name"
    if [[ -n "$aws_profile" ]]; then
      echo "  AWS Profile: $aws_profile"
    fi
    echo
    
    # Confirm with user
    read -p "Continue with this configuration? (y/N): " -r
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        echo "Aborted."
        exit 0
    fi
    echo
    
    # Check prerequisites
    check_prerequisites
    echo
    
    # Create OIDC provider
    local provider_arn=$(create_oidc_provider)
    echo
    
    # Create trust policy
    log "Generating trust policy..."
    create_trust_policy "$github_org" "$repo_name" "$branch" "$provider_arn" > /tmp/trust-policy.json

    echo "----- Trust Policy Document -----"
    cat /tmp/trust-policy.json
    echo "---------------------------------"

    if ! jq . /tmp/trust-policy.json > /dev/null 2>&1; then
      error "Generated trust policy is not valid JSON!"
    fi
    echo
    
    # Create role
    local role_arn=$(create_role "$role_name" "$policy_name" "/tmp/trust-policy.json" "$github_org" "$repo_name")
    echo
    
    # Success summary
    success "GitHub OIDC setup complete!"
    echo
    echo "Summary:"
    echo "  OIDC Provider: $provider_arn"
    echo "  IAM Role: $role_arn"
    echo "  Policy: $policy_name"
    echo
    
    echo
    echo "Setup complete! Copy the role ARN above to use in your GitHub Actions workflows."
    echo "Make sure your workflows include 'permissions: id-token: write'"
}

# Run main function
main "$@"