CCL-509 filtering for specific branch using subject claims for resour…

…ce 'aws_iam_role'
UKHomeOffice · Aug 30, 2024 · c5a6c71 · c5a6c71
1 parent 6da3bb2
commit c5a6c71
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 11 deletions.
diff --git a/modules/products/static-site/iam.tf b/modules/products/static-site/iam.tf
@@ -18,7 +18,7 @@ resource "aws_iam_role" "static_site_actions_push" {
         }
         Condition = {
           StringLike = {
-            "token.actions.githubusercontent.com:sub" : "repo:${var.tenant_vars.repository}:${var.tenant_vars.gitbranch}"
+            "token.actions.githubusercontent.com:sub" : "repo:${var.tenant_vars.repository}:ref:refs/heads/${var.tenant_vars.gitbranch}"
             "sts:RoleSessionName" : "GitHubActions"
           }
           StringEquals = {

diff --git a/modules/products/static-site/variables.tf b/modules/products/static-site/variables.tf
@@ -9,13 +9,3 @@ variable "cloud_front_default_vars" {
 variable "aws_region" {
   type = string
 }
-
-variable "git_branch" {
-  type        = string
-  description = "git branches which can push to S3 from "
-
-  validation {
-    condition     = contains(var.git_branch, "main") || contains(var.git_branch, "master") || contains(var.git_branch, "CCL-509")
-    error_message = "valid push branches are [main,master,CCL-509]"
-  }
-}