HCP Terraform AWS OIDC 連携

sts:AssumeRoleWithWebIdentityなポリシーのロールを作ってARNを変数に入れるだけ ARNだからロール名だけでは足りない

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "OIDC_PROVIDER_ARN"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "SITE_ADDRESS:aud": "AUDIENCE_VALUE",
                    "SITE_ADDRESS:sub": "organization:ORG_NAME:project:PROJECT_NAME:workspace:WORKSPACE_NAME:run_phase:RUN_PHASE"
                }
            }
        }
    ]
}

• TFC_AWS_PROVIDER_AUTH
• TFC_AWS_RUN_ROLE_ARN

persol-serverworks.co.jp

developer.hashicorp.com