terraform-cicd-pipeline

Complete CI/CD infrastructure for deploying containerized apps to AWS. Creates ECR repository, GitHub Actions OIDC auth (no access keys!), and includes ready-to-use workflow templates for ECS and EKS deployments.

Features

• ECR Repository — Private container registry with image scanning and lifecycle policy
• GitHub OIDC — Secure, keyless authentication (no AWS access keys in GitHub secrets)
• Immutable tags — Prevents image tag overwriting
• Workflow templates — Copy-paste GitHub Actions for ECS and EKS deployments
• IAM User option — For non-GitHub CI/CD systems (Jenkins, GitLab, etc.)

Usage

With GitHub Actions (recommended)

module "pipeline" {
  source = "github.com/akshayghalme/terraform-cicd-pipeline"

  service_name    = "my-api"
  use_github_oidc = true
  github_repo     = "akshayghalme/my-api"   # owner/repo

  tags = { Environment = "production" }
}

output "ecr_url" {
  value = module.pipeline.ecr_repository_url
}

output "role_arn" {
  value = module.pipeline.github_actions_role_arn
  # Add this as AWS_ROLE_ARN secret in your GitHub repo
}

Setup Steps

1. Run terraform apply — creates ECR + OIDC role
2. Copy the role_arn output
3. Add it as AWS_ROLE_ARN secret in your GitHub repo settings
4. Copy templates/deploy-ecs.yml to your app repo's .github/workflows/
5. Update the env variables in the workflow file
6. Push to main — it deploys automatically

With IAM User (Jenkins, GitLab, etc.)

module "pipeline" {
  source = "github.com/akshayghalme/terraform-cicd-pipeline"

  service_name     = "my-api"
  use_github_oidc  = false
  create_cicd_user = true

  tags = { Environment = "production" }
}

Included Workflow Templates

Template	Deploys to	File
deploy-ecs.yml	ECS Fargate	templates/deploy-ecs.yml
deploy-eks.yml	EKS Kubernetes	templates/deploy-eks.yml

Why OIDC over Access Keys?

	OIDC	Access Keys
Security	Short-lived tokens	Long-lived credentials
Key rotation	Not needed	Manual rotation required
Leak risk	No keys to leak	Keys can be exposed
Setup	Slightly more complex	Simple but risky

Always prefer OIDC for GitHub Actions.

Inputs

Name	Description	Default
service_name	Service/app name	required
use_github_oidc	Use GitHub OIDC auth	true
github_repo	GitHub repo (owner/repo)	""
create_cicd_user	Create IAM user instead	false
ecr_max_images	Max images to keep	20

Outputs

Name	Description
ecr_repository_url	ECR URL for docker push
github_actions_role_arn	Role ARN for GitHub secrets

License

MIT

Author

Akshay Ghalme — akshayghalme.com